Here, this post will help you in the deployment of the Prevent the Use of Security Questions for Local Accounts using Intune Policy. We’ll make use of Intune’s Settings Catalog to install this policy. We are using configuration Profiles of Intune to deploy the Prevent the Use of Security Questions for Local Accounts Using Intune Policy.
Prevent the Use of Security Questions for Local Accounts Policy setting governs the use of security questions for resetting passwords on local accounts. It’s important to note that the security question feature is exclusive to local accounts on the workstation and does not apply to domain accounts.
Users might create security questions that are easily discoverable or inferred by observing their social media accounts. This makes it more convenient for a malicious actor to alter the password for the local user account, subsequently gaining unauthorized access to the computer under that user account.
Organizations often assess and implement password reset policies as part of their broader security strategy. The inclusion or exclusion of security questions is influenced by security best practices and compliance requirements.
Administrators can configure this policy setting based on the security and access requirements of the organization, determining whether or not security questions are a permissible method for local account password resets. The recommended state for this setting is Enabled.
- Deploy Intune Let Apps Activate With Voice Above Lock Policy
- Intune Allow Microsoft Accounts to be Optional Policy
Prevent the Use of Security Questions for Local Accounts Policy
To create a Prevent the Use of Security Questions for Local Accounts Policy, follow the steps stated below:
- Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
- Select Devices > Windows > Configuration profiles > Create a profile.
In Create Profile, I select Windows 10 and later in Platform and select Profile Type as Settings catalog. Click on the Create button.
On the Basics tab pane, I provide a name for the policy “Prevent the Use of Security Questions for Local Accounts Policy.”
- Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.
Now in Configuration Settings, Click Add Settings to browse or search the catalog for the settings I want to configure.
In the Settings Picker windows. I searched for the keyword Credential User Interface. I found the category Administrative Templates\Windows Components\Credential User Interface and selected this.
- When I select that option as stated above, I see the sub-category Prevent the use of security questions for local accounts. After selecting that, click the cross mark at the right-hand corner, as shown below.
Here in Administrative Templates, I have enabled the Prevent the use of security questions for local accounts.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.
- Click Next to continue.
Now in Assignments, in Included Groups, you need to click on Add Groups and choose Select Groups to include one or more groups. Click Next to continue.
In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.
After successfully creating the “Prevent the Use of Security Questions for Local Accounts Policy,” a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for Prevent the Use of Security Questions for Local Accounts Policy
To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list, which is the Prevent the Use of Security Questions for Local Accounts Policy. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.
- If you require more detailed information, you can click on “View Report” to access additional insights.
Intune MDM Event Log – Prevent the Use of Security Questions for Local Accounts Policy
You can leverage event IDs 813 and 814 to verify the successful implementation of String or integer policies for the Prevent the Use of Security Questions for Local Accounts Policy on Windows 10 or 11 devices through Intune.
These event IDs provide valuable insights into the Prevent the Use of Security Questions for Local Accounts Policy’s application status and the specific value assigned to the policy on those devices. In the case of this particular policy, the value is String and is linked to the event ID 814.
By analyzing these event IDs, you can clearly understand the policy’s application status and the corresponding value associated with it on the devices in question.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (