u/eidercollider

I'm using Nessus and working though CIS baseline compliance for Windows 11 Enterprise, and there are some controls for User Config settings, e.g.

User Config\Policies\Administrative Templates\Windows Components\Cloud Content\Configure Windows Spotlight on lock screen

The issue is that some of my systems have a local user account installed by some third-party software. This account never logs in, so it never picks up the user policy, and the nessus scan picks up the non-compliant registry entry, e.g.

HKU\<SID>\Software\Policies\Microsoft\Windows\Cloudcontent

Is there some magic command that I can use to tell the system to apply the user policy to a local account?

Hi, I'm working through CIS Baseline compliance and one of the controls is to set "Interactive Logon: Smart Card Removal Behaviour" to "Lock workstation".

However, when I set this on a test machine, I completely lose the ability to RDP to it - I don't even get a login prompt. Local login still works fine.

We don't use smart cards, so I have no experience of what complexities they bring.

Is this normal/expected, and if so, is there a way to enable this control and still retain the ability to RDP?

Thanks!

Hi, I have SSSD configured on Ubuntu 24.04 (via realm join) This works fine However, during testing I noticed that in the situation where the system lacked connectivity to the global catalog server (domain controller, tcp/3268) then attempting to log in with a local account was extremely slow (10s+)

This felt like it was attempting to query the username on the network first before timing out and falling back to checking locally

I've checked /etc/nsswitch.conf and it's as expected:

passwd, group, shadow: files systemd sss
gshadow: files systemd 

Does anyone know where this delay might be coming from?

I am not using fully qualified names for logins so that may be part of the problem...

Many thanks!

*edit - formatting