Show list of Users on Windows Login Window

Question

Hello

We have a customer with Active Directory and IMAP-Mailaccounts.

There on the Windows we finalize every account eligible for login with manually adding they're IMAP-Account.

Is there some posibility to have those Devices connected to the Active Directory (like now) and listed every User who is eligible for the specific Device, to get access with IMAP but keep the possibility to allow them to log-in to the Device?

Greetings,

calgia

Answer 1

Hello

Thank you for posting in Q&A forum.

There isn’t an existing Windows setting that “knows” about IMAP eligibility and then shows only those users on the logon screen. In a domain‐joined environment the Windows sign‐in experience (via the Credential Provider) is designed to show either a cached list of local users (for a workstation) or simply an “Other user” box (for domain accounts), not a filtered list based on external criteria such as an IMAP account.

You might consider if you want to display only the users eligible (such as IMAP–assignment or other criteria):

1. Custom Credential Provider:

Windows allows you to write your own Credential Provider using the Credential Provider API.  

1-1 In a custom provider you could, for example, query Active Directory (or a custom data source) for users who are assigned a particular attribute or membership (say, a specific AD group or even a custom attribute that indicates IMAP–account assignment).  

1-2 The provider would then display only those users in the logon UI.  

1-3 When the user selects one of these accounts, the provider would then carry out the authentication.

2. Third–Party Solution:

There are commercial products and identity management solutions that sometimes offer “enhanced” logon experiences and may allow you to integrate custom eligibility criteria. Such solutions may already have mechanisms to combine domain authentication with other identity sources (like an IMAP server if that is supported on your end).

Note:

The custom Credential Provider is probably the most direct route if you need a login UI that directly reflects the eligibility criteria you’ve created. However, developing and supporting such a provider means you’ll be responsible for all the security risks and stability issues that might come up with a highly customized logon experience.

References:

https://learn.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows

https://support.microsoft.com/en-us/office/what-are-imap-and-pop-ca2c5799-49f9-4079-aefe-ddca85d5b1c9

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.