Managing user sign-in options
Windows 11 Enterprise offers a range of configurable options to manage the account logon process. Some of the features are designed to increase security, while others are to improve the user experience. It’s worth mentioning that with Multifactor Authentication in use, the password strength for a user is less of a bulwark for enterprise security.
The following settings can be configured via GPO to ensure a consistent approach across all domain-joined computers:
- Turn on convenience PIN: This setting should be disabled as it causes the password to be cached in the system vault; instead, use the Hello for Business feature that we will see later in this chapter.
- Turn off picture password sign-in: This policy should be enabled to prevent the use of this feature. Picture password sign-in enables the user to sign in with a unique gesture based on their picture, but also causes the user’s password to be cached in the system vault....
