how to block a windows device for any user

Question

how to block a windows device for any user

Douglas Bonilla 61

Hey guys, I'm looking for a solution similar to android and ios devices that can be locked remotely and can't be accessed, but this feature is not available for windows.

Is there any configuration I can make to achieve a similar result?

Answer 1

There is no direct way to accomplish this for a variety of reasons, mainly because on a technical level, it's just not the same as Android and iOS where the OS is more or less symbiotic and co-exists with the hardware.

The closest you can get with Windows is to force a BitLocker PIN recovery and restart the device immediately after. If the user has or can obtain the recovery key though, then this won't have any effect. The path we recommend is two-fold: use BitLocker protection and wipe the device if it is lost, stolen, or compromised.

What's the scenario here where you desire this functionality?

Keep in mind that a thief or malicious user can just yank the hard drive so you won't be able to prevent theft. Also, in both cases, the person in possession of the device simply doesn't have to connect it to the Internet in which case, there's nothing additional that you can do.

Some hardware vendors have deeper, hardware-based paths that may help. As noted, it all depends on what your scenario and goals are here as there is no direct parallel operation since the nature of the devices, OS, and hardware are very different.

Answer 2

Hi @Douglas Bonilla

If I understand your question correctly, you are looking to block Windows personal devices. Please take a look at the following article:

How to Block Personal Windows Devices Enrollment Enrollment restrictions Options

https://www.anoopcnair.com/block-personal-windows-devices/

----------------------------

If this is helpful please accept answer.

Answer 3

Douglas Bonilla 61

no that is not my question, it is how I can block access to a device so that it can not be used

Answer 4

Bagitman 571

Windows 10 and 11 have such a function built-in: https://support.microsoft.com/en-us/account-billing/find-and-lock-a-lost-windows-device-890bf25e-b8ba-d3fe-8253-e98a12f26316

Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-24T18:31:42.4+00:00

This simply locks the current logon if there is one. It's meant for stolen devices where you think a user may be logged on. It won't lock out an existing user that has correct credentials. As called out as well, if the device isn't online, this is also completely useless.
Bagitman 571 Reputation points

2022-10-25T20:25:13.83+00:00

It will lockout an existing user with correct credentials - if he's just a user, not an admin.
Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-25T20:44:31.287+00:00

Sorry, not following this statement. As I called out, it does not "lockout" anyone or anything, it just locks the desktop. The user can still unlock the desktop using their credentials. Admin or not is irrelevant.
Bagitman 571 Reputation points

2022-10-25T20:59:54.05+00:00

Jason, you seem to be very confident. See, I use this feature and yes, MS even tells you how it works when you are about to enable it: no one may logon afterwards but admins. So if you were so wise to enable Bitlocker as well, a thief may not login with knowing an admin pw.
Bagitman 571 Reputation points

2022-10-25T21:06:34.767+00:00

See here:
Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-25T21:20:59.807+00:00

Yes and no. I was a bit premature with stating the actual functionality here, however, this functionality is only relevant and works for local user accounts on non-domain, non-AAD joined devices.

Regardless, my points above still stand. This only has value if the device is connected to the Internet and has no value in deterring theft or protecting data without BitLocker in the mix. Even with BitLocker in the mix, if the user has the BitLocker recovery key, all bets are off. The point here is that there simply are far too many caveats and what ifs that this is not a mechanism that any enterprise could or should rely on (even if it was available to them). This is also why the scenario and goals here are super important. For commercial devices, the best path as noted, is to wipe the device.
Bagitman 571 Reputation points

2022-10-25T21:40:53.707+00:00

"This only has value if the device is connected to the Internet" - only logical, who would question that?
About "this functionality is only relevant and works for local user accounts on non-domain, non-AAD joined devices" - again a bit premature.
It works on domain joined devices as well. I tried on premises AD, but did not try Azure AD, though.
Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-25T22:14:19.137+00:00

It works on domain joined devices as well

Given that you can only log into https://account.microsoft.com/devices with an MSA, I don't see how that's possible -- yes, you can see the device in that portal if you've used SSO on the device for that MSA, but it does not allow you to see the device's location or lock it to my knowledge. Also, the functionality disables local accounts which have near zero value or use on domain joined systems so that wouldn't have any end effect anyway.

None of this changes the point though that there's little to no value in doing this anyway if you don't have control and possession of the hardware. Just doing a random operation for the sake of doing a random operation without understanding the bigger goal and scenario is just that: random. It doesn't actually do any of value.
Bagitman 571 Reputation points

2022-10-25T22:53:46.54+00:00

Feel free to verify this. You can add an MS account to a domain joined device and see that location and lock it - that's what I told you I did.
You cannot logon with a domain account, either, when it's locked, just with that administrative MS account.
Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-26T15:01:31.073+00:00

You can add an MS account

How exactly did you do this?

The question still remains here though, what's the value in doing this? What problem does it actually solve?
Douglas Bonilla 61 Reputation points

2022-10-26T15:08:45.837+00:00

I do not find it useful since we do not have those accounts, we use 365 corporatives, Computers are linked to Azure with adjoin. That's why I'm looking for a solution with Intune
Bagitman 571 Reputation points

2022-10-26T19:10:21.71+00:00

"How exactly did you do this?" - settings ->accounts->other users->add other user->add account->input MS account credentials. Just the way you would expect. It is well known that MS allows parallel usage of domain devices with MS accounts and on premises domain accounts.
"The question still remains here though, what's the value in doing this? What problem does it actually solve?" - ask MS. If you haven't found out by now what it does, I am unsure if I am able to tell you. I see reasons to use this.
Bagitman 571 Reputation points

2022-10-26T19:11:11.183+00:00

"That's why I'm looking for a solution with Intune" - you can take from my link that this works with intune. Even remote wiping works with intune.
Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-26T19:40:55.103+00:00

Adding MSA accounts is not something allowed in commercial environments and all standard security baselines explicitly exclude doing this.

I see reasons to use this.

You keep dodging the question of how or why this has any value or what scenarios you would use this in that are relevant to a commercial environment or IT Pro managing commercial devices.
Bagitman 571 Reputation points

2022-10-27T18:36:41.39+00:00

Adding MSA accounts is not something allowed in commercial environments and all standard security baselines explicitly exclude doing this.

The Win11/Win10 22H2 security baselines from MS don't suggest to disallow MS accounts,

Look, the function to be able to locate a device when it's lost (or stolen - who knows that for sure when one can't find it), is something good. That function is not available with internet connection, ok, but often thieves turn devices on and devices might connect a way or the other, transferring their location, allowing to wipe it if you feel the need.

Or you see your sister has taken your laptop - why not simply log her off and lock her out? You can do it.
It has been asked for here - it works with intune, something the asker is even using, I gave a hint, since I saw that someone else told him there is no such function. I did not come here in search for a discussion. Let's leave it.
Jason Sandys 31,071 Reputation points Microsoft Employee

2022-10-27T19:00:02.857+00:00

No one is questioning device location or wipe whatsoever. I've from the beginning of this thread called out wipe as the best option to use in combination with BitLocker (today). I'm specifically asking about the lock function that you called out and how you see that as having value in a commercial scenario and what problem it solves in a commercial scenario?

The Win11/Win10 22H2 security baselines from MS don't suggest to disallow MS accounts,

That's most likely because you have to be a local admin to do this in the first place and that's strongly discouraged.

how to block a windows device for any user

3 additional answers

Activity