Intune Policy to Enable Interactive Logon Do Not Display Last Signed-in

This article is designed to take you through creating an Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in. We’ll make use of Intune’s Settings Catalog to enforce this policy.

Interactive logon Don’t display last signed-in Policy security configuration dictates whether the Windows sign-in screen will reveal the username of the most recent user who signed in on this PC. Enabling this policy ensures that the username remains undisclosed while disabling it allows the display of the username. The default setting is disabled.

A potential threat actor with console access, such as someone with physical proximity or the ability to connect through Remote Desktop Services, may observe the username of the most recent user who logged onto the server. Subsequently, the attacker might attempt to guess the password, employ a dictionary attack, or execute a brute-force attack to gain unauthorized access.

Understanding the default behaviour is crucial for administrators managing security policies across different Windows environments. This security setting applies to various Windows versions, and the default configuration may vary.

Patch My PC
Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.1
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.1

Enable Interactive logon Don’t display Last Signed-in Intune

To implement Enable Interactive logon Don’t display last signed-in Policy Utilizing Intune, follow the steps stated below:

  • Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
  • Select Devices > Windows > Configuration profiles > Create a profile.

In Create Profile, I select Windows 10 and later in Platform and select Profile Type as Settings catalog. Click on the Create button.

Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.2
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.2

On the Basics tab pane, I provide a name for the policy as “Enable Interactive logon Don’t display last signed-in Policy.”

  • Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.
Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.3
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.3

Now in Configuration Settings, Click Add Settings to browse or search the catalog for the settings I want to configure.

Adaptiva
Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.4
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.4

In the Settings Picker windows. I searched for the keyword Interactive logon. I found the category Local Policies Security Options and selected this.

When I select that option as stated above, I see the sub-category Interactive Logon Do Not Display Last Signed In. After selecting that, click the cross mark at the right-hand corner, as shown below.

Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.5
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.5

Here I choose Enabled (username will not be shown) for Interactive Logon Do Not Display Last Signed In in Local Policies Security Options.

Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.6
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.6

Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.

  • Click Next to continue.

Now in Assignments, in Included Groups, you need to click on Add Groups and choose Select Groups to include one or more groups. Click Next to continue.

Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.7
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.7

In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.

Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.8
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.8

After successfully creating the “Enable Interactive logon Don’t display last signed-in Policy,” a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.

Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.

Intune Report for Enable Interactive logon Don’t display last signed-in Policy

From the Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.

To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.

  • If you require more detailed information, you can click on “View Report” to access additional insights.
Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.9
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.9

Windows CSP Details InteractiveLogon_DoNotDisplayLastSignedIn

We will see Windows CSP Details for this Policy setting InteractiveLogon_DoNotDisplayLastSignedIn. Administrators can tailor the sign-in screen behaviour by configuring the “Interactive logon: Don’t display last signed-in” policy to meet their organisation’s security and user experience requirements.

CSP URI – ./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn

Enable Interactive logon Don't display last signed-in Policy Utilizing Intune Fig.10
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.10

Intune MDM Event Log – Interactive logon Don’t display last signed-in Policy

To verify the successful implementation of String or integer policies for Interactive logon Don’t display last signed-in Policy on Windows 10 or 11 devices through Intune, you can leverage event IDs 813 and 814.

These event IDs provide valuable insights into the Blocking Microsoft Accounts Policy’s application status and the specific value assigned to the policy on those devices. In the case of this particular policy, the value is an Integer and is linked to the event ID 813.

By analyzing these event IDs, you can gain a clear understanding of the policy’s application status and the corresponding value associated with it on the devices in question.

To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.

MDM PolicyManager: Set policy string, Policy: (InteractiveLogon_DoNotDisplayLastSignedIn), Area: (LocalPoliciesSecurityOptions), EnrollmentID requesting merge: (5B88AEF1-09E8-43BB-B144-7254ACBBDF3E), Current User: (Device), Int: (0x1), Enrollment Type: (0x6), Scope: (0x0).

Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.11
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.11

When I opened the above Event log, I found that the Enable Interactive logon Don’t display the last signed-in Policy I applied to the device was successfully implemented.

  • By reviewing the log entry shown in the above image, the Event Viewer, I came across essential information, including the Area and Enrollment ID.

These details play a significant role in identifying the corresponding registry path. To locate the specific information, please consult the table provided below:

AreaPolicyIntegerScopedEvent ID
LocalPoliciesSecurityOptionsInteractiveLogon_DoNotDisplayLastSignedIn1Device813
Table 1 – Enable Interactive logon Don’t display last signed-in Policy Utilizing Intune

The details presented in the table above for the Enable Interactive logon Don’t display last signed-in Policy Utilizing Intune can be employed to access the registry settings that hold the group policy configurations on a specific computer. To accomplish this, you can execute “REGEDIT.exe” on the target computer and navigate to the precise registry path where these settings are stored.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\5B88AEF1-09E8-43BB-B144-7254ACBBDF3E\default\Device\LocalPoliciesSecurityOptions

When you navigate the above path in the Registry Editor, you will find the registry key named InteractiveLogon_DoNotDisplayLastSignedIn. Also, when I navigated to the above path, I saw that the Registry Key was created successfully.

Registry NameValue
InteractiveLogon_DoNotDisplayLastSignedInEnabled
Table 2 – Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in
Intune Policy to Enable Interactive Logon Don't Display Last Signed-in Fig.12
Intune Policy to Enable Interactive Logon Don’t Display Last Signed-in Fig.12

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click hereHTMD WhatsApp.

Author

Abhinav Rana is working as an SCCM and Intune Admin with several years of experience. He loves to help the community by sharing his knowledge. He is a B.Tech graduate in Information Technology.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.