Forum Discussion

hkusulja's avatar
May 24, 2019

Best practice for Win10 local admin user when computer offline

I have question about your best practices for organizations.

 

Scenario:

You have only Azure AD joined - Windows 10 computers, with Intune MDM management. Only one user is using Windows 10 PC device, and has local admin rights. Additional Azure AD users are deployed as local administrators to the device. There is also Bitlocker encryption and secure boot implemented.

 

Challenge:

What if user forgets the password (or user is no longer active in organization), and device goes offline (example network card driver issue), how can other users / Azure AD users, login to the device, to fix the issue on local windows?

 

Possible solution would be to deploy always additional local windows account, with admin rights, but this always has sign-in disabled (since Intune enforces this).

 

What do you recommend?

  • RobdeRoos's avatar
    RobdeRoos
    Iron Contributor

    hkusulja When a device gets transferred from one user to another I reccomend you do a wipe/reset of the device. That way the new user will become the primary user of the device.

     

    For the password issue, add a password reset option to the logon screen by adding the following custom policy:

    Name: Windows 10 Password Reset

    Description: Add Password Reset to Windows 10 Logon

    OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Authentication/AllowAadPasswordReset

    Data Type: Integer

    Value: 1

     

    In my opinion a local account isn't needed. I use Intune a lot of years now and never had to cope with an issue where users couldn't logon to their devices.

    • hkusulja's avatar
      hkusulja
      MVP

      RobdeRoos I do have enable this CSP Policy, but it does not have nothing with this question.

       

      Example scenario:
       - intune user is using windows 10 device, everything works, the user is only local user with local admin rights

       - device is updated and network card driver is broken

       - user and user-admin can not login with their intune accounts, since there is no network connectivity...

      • Kevin Truong's avatar
        Kevin Truong
        Copper Contributor

        hkusulja Did you ever get this figured out? I am in the same situation. Since we have alot of remote users.

Resources