Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Sign-in and accounts

Every setting of the “Sign-in and accounts” package with its effect, value and recommending sources.

since 0.9.8.11

Purpose

This page lists every setting of the “Sign-in and accounts” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

21 settings.

Notes

User Account Control: Behavior of the elevation prompt for standard users

The ConsentPromptBehaviorUser DWORD value controls how User Account Control responds when a standard user initiates an operation that requires elevation.

Enumerate administrator accounts on elevation

This machine-wide registry value controls whether Windows displays the computer's local administrator accounts for selection when an elevation request requires credentials.

Require a password when a computer wakes (on battery)

This machine-wide registry value determines whether Windows returns to the secure desktop and requires the user to sign in again when the computer resumes from sleep while running on battery power.

Require a password when a computer wakes (plugged in)

This registry value controls whether Windows returns to the secure desktop and requires authentication when the system resumes from sleep while connected to AC power.

Sign-in and lock last interactive user automatically after a restart

This value controls Winlogon Automatic Restart Sign-On (ARSO). Following an eligible restart, or a shutdown followed by a cold boot, ARSO signs in the last interactive user automatically and immediately locks the resulting session. The lock still requires authentication before anyone can access the desktop.

Allow Custom SSPs and APs to be loaded into LSASS

This registry value stores the state of a computer-scoped ADMX Group Policy setting. It controls whether the Local Security Authority (LSA) may load custom security support providers (SSPs) and authentication packages (APs) into the Local Security Authority Subsystem Service (LSASS) process.

Logon options

The 1A00 DWORD value controls how credentials are handled when a website in the Restricted Sites Zone requests HTTP authentication. It represents the URLACTION_CREDENTIALS_USE URL action.

Apply UAC restrictions to local accounts on network logons

This registry value controls UAC access-token filtering when local Security Accounts Manager (SAM) accounts authenticate to the computer through a network logon. With type REG_DWORD and value data 0, Windows creates a filtered access token for a local administrator account. Administrative capabilities are removed from the token available to that remote session.

Network access: Do not allow anonymous enumeration of SAM accounts

A DWORD value of 1 represents the enabled state of this Windows security option. It prevents unauthenticated connections from anonymously enumerating account names managed through the Security Accounts Manager (SAM).

User Account Control: Admin Approval Mode for the Built-in Administrator account

Setting the FilterAdministratorToken DWORD value to 1 places only the built-in Administrator account—the local account with relative identifier (RID) 500—in User Account Control (UAC) Admin Approval Mode.

Configures LSASS to run as a protected process

The RunAsPPL registry value controls whether the Local Security Authority process (LSASS.exe) runs with added LSA protection as a Protected Process Light (PPL). LSASS performs functions that include validating local and remote sign-ins, enforcing local security policy, and managing credentials used for authentication.

Accounts: Limit local account use of blank passwords to console logon only

LimitBlankPasswordUse is a DWORD value associated with the corresponding Windows security option. A value of 1 enables the restriction: a local user account with a blank password cannot be used for network logons or remote interactive logons. This includes, for example, Remote Desktop Services and network services that rely on Windows authentication.

Network security: Do not store LAN Manager hash value on next password change

The NoLMHash DWORD value set to 1 prevents Windows from generating and storing a LAN Manager password hash (LM hash) when an account password is next set or changed. For local accounts, this affects the local Security Accounts Manager (SAM) database. On domain controllers, it affects domain-account password data stored in Active Directory.

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

The DWORD value 2 specifies that administrators operating in Admin Approval Mode must explicitly approve or deny an elevation request on the secure desktop. The UAC prompt presents a Yes-or-No consent choice and does not require the administrator to enter credentials.

User Account Control: Run all administrators in Admin Approval Mode

The EnableLUA DWORD value controls whether User Account Control (UAC) and Admin Approval Mode are enabled system-wide. A value of 1 enables these features.

WDigest Authentication

The UseLogonCredential DWORD value controls whether WDigest stores credentials in memory. A value of 0 prevents WDigest from retaining password credentials in memory for subsequent reuse.

Prevent enabling lock screen camera

This device-wide policy prevents an available camera from being invoked from the Windows lock screen. It also disables the corresponding control in Windows settings, so users cannot enable lock-screen camera access themselves.

Allow Windows Ink Workspace

This device-wide policy value controls whether users can access Windows Ink Workspace and whether the workspace remains available while the device is locked.

Turn off Push To Install service

This computer-scoped policy controls whether users can push apps to this device for installation from Microsoft Store on another device or on the web.

RunAsPPL

Description to follow.

Network security: LAN Manager authentication level

The DWORD value 5 corresponds to Send NTLMv2 responses only. Refuse LM & NTLM. For network logons that use NTLM challenge-response authentication, the computer generates only NTLMv2 responses when acting as a client. It also uses NTLMv2 session security when the remote system supports it.

See also