Deny Logon doesn't work with shared PC mode?
I have been trying to figure out a deny logon plan for our autopilot devices, and for a while I was thinking nothing was working, even when trying to manually make the changes that I want Intune to do.
I decided to try with a configuration that is setup for individual users, rather than using the "shared PC mode" or "Shared multi-user device" setting. During that test the user was blocked from login and I could have been done. My problem is the shared devices are the ones that I want these users blocked from, and none of the traditional ways are working. Is there a setting that can be changed that will help, has anyone else had this problem?
The 2 main methods I tried were adding the SID of the group to the Deny Logon Local Policy, and adding the SID to a Local Group (both self created and built-in) and then denying logon to the Local Group in the Local Policy.
The group I am using is an AzureAD group, and the test device has been a freshly wiped Autopilot device.