12 KiB
title, description, ms.author, ms.localizationpriority, ms.topic, ms.prod, ms.technology, author, ms.date, ms.reviewer, manager
| title | description | ms.author | ms.localizationpriority | ms.topic | ms.prod | ms.technology | author | ms.date | ms.reviewer | manager |
|---|---|---|---|---|---|---|---|---|---|---|
| Policy CSP - ADMX_WinLogon | Policy CSP - ADMX_WinLogon | vinpa | medium | article | w10 | windows | vinaypamnani-msft | 11/09/2020 | aaroncz |
Policy CSP - ADMX_WinLogon
Tip
These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.
You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.
The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.
ADMX_WinLogon policies
- ADMX_WinLogon/CustomShell
- ADMX_WinLogon/DisplayLastLogonInfoDescription
- ADMX_WinLogon/LogonHoursNotificationPolicyDescription
- ADMX_WinLogon/LogonHoursPolicyDescription
- ADMX_WinLogon/ReportCachedLogonPolicyDescription
- ADMX_WinLogon/SoftwareSASGeneration
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Windows SE | No | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
Specifies an alternate user interface. The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface.
If you enable this setting, the system starts the interface you specify instead of Explorer.exe. To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file isn't located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file.
If you disable this setting or don't configure it, the setting is ignored and the system displays the Explorer interface.
Tip
To find the folders indicated by the Path environment variable, click System Properties in Control Panel, click the Advanced tab, click the Environment Variables button, and then, in the System variables box, click Path.
ADMX Info:
- GP Friendly name: Custom User Interface
- GP name: CustomShell
- GP path: System
- GP ADMX file name: WinLogon.admx
ADMX_WinLogon/DisplayLastLogonInfoDescription
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Windows SE | No | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
This policy setting controls whether or not the system displays information about previous sign-ins and sign-in failures to the user.
For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last successful sign in by that user, the date and time of the last unsuccessful sign in attempted with that user name, and the number of unsuccessful logons since the last successful sign in by that user. This message must be acknowledged by the user before the user is presented with the Microsoft Windows desktop.
For domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows couldn't retrieve the information and the user won't be able to sign in. Therefore, you shouldn't enable this policy setting if the domain isn't at the Windows Server 2008 domain functional level.
If you disable or don't configure this setting, messages about the previous sign in or sign-in failures aren't displayed.
ADMX Info:
- GP Friendly name: Display information about previous logons during user logon
- GP name: DisplayLastLogonInfoDescription
- GP path: Windows Components\Windows Logon Options
- GP ADMX file name: WinLogon.admx
ADMX_WinLogon/LogonHoursNotificationPolicyDescription
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Windows SE | No | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy controls whether the signed-in user should be notified when their sign-in hours are about to expire. By default, a user is notified before sign-in hours expire, if actions have been set to occur when the sign-in hours expire.
If you enable this setting, warnings aren't displayed to the user before the sign-in hours expire.
If you disable or don't configure this setting, users receive warnings before the sign-in hours expire, if actions have been set to occur when the sign-in hours expire.
Note
If you configure this setting, you might want to examine and appropriately configure the “Set action to take when logon hours expire” setting. If “Set action to take when logon hours expire” is disabled or not configured, the “Remove logon hours expiration warnings” setting will have no effect, and users receive no warnings about logon hour expiration
ADMX Info:
- GP Friendly name: Remove logon hours expiration warnings
- GP name: LogonHoursNotificationPolicyDescription
- GP path: Windows Components\Windows Logon Options
- GP ADMX file name: WinLogon.admx
ADMX_WinLogon/LogonHoursPolicyDescription
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Windows SE | No | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy controls which action will be taken when the sign-in hours expire for the logged on user. The actions include lock the workstation, disconnect the user, or log the user off completely.
If you choose to lock or disconnect a session, the user can't unlock the session or reconnect except during permitted sign-in hours.
If you choose to sign out a user, the user can't sign in again except during permitted sign-in hours. If you choose to sign out a user, the user might lose unsaved data. If you enable this setting, the system will perform the action you specify when the user’s sign-in hours expire.
If you disable or don't configure this setting, the system takes no action when the user’s sign-in hours expire. The user can continue the existing session, but can't sign in to a new session.
Note
If you configure this setting, you might want to examine and appropriately configure the “Remove logon hours expiration warnings” setting.
ADMX Info:
- GP Friendly name: Set action to take when logon hours expire
- GP name: LogonHoursPolicyDescription
- GP path: Windows Components\Windows Logon Options
- GP ADMX file name: WinLogon.admx
ADMX_WinLogon/ReportCachedLogonPolicyDescription
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Windows SE | No | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
- User
This policy controls whether the signed-in user should be notified if the sign-in server couldn't be contacted during sign in and if they've been signed in using previously stored account information.
If enabled, a notification popup will be displayed to the user when the user logs on with cached credentials.
If disabled or not configured, no pop up will be displayed to the user.
ADMX Info:
- GP Friendly name: Report when logon server was not available during user logon
- GP name: ReportCachedLogonPolicyDescription
- GP path: Windows Components\Windows Logon Options
- GP ADMX file name: WinLogon.admx
ADMX_WinLogon/SoftwareSASGeneration
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Windows SE | No | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
This policy setting controls whether the software can simulate the Secure Attention Sequence (SAS).
If you enable this policy setting, you have one of four options:
- If you set this policy setting to "None," user mode software can't simulate the SAS.
- If you set this policy setting to "Services," services can simulate the SAS.
- If you set this policy setting to "Ease of Access applications," Ease of Access applications can simulate the SAS.
- If you set this policy setting to "Services and Ease of Access applications," both services and Ease of Access applications can simulate the SAS.
If you disable or don't configure this setting, only Ease of Access applications running on the secure desktop can simulate the SAS.
ADMX Info:
- GP Friendly name: Disable or enable software Secure Attention Sequence
- GP name: SoftwareSASGeneration
- GP path: Windows Components\Windows Logon Options
- GP ADMX file name: WinLogon.admx