SSPR with CIS hardening for Windows 10

Question

SSPR is working well but i have to use CIS hardening for Microsoft Windows 10 Enterprise (1.12.0).

Now, the SSPR on windows 10 login page don't work anymore : a session seems to open and close immediatly.

Can you help me ? what kind of rights are used to open a SSPR session ?

(i've already allowed :

• AllowPasswordReset
• DontDisplayLastUserName
• NoLockScreen
• DisableLockScreenAppNotifications)

( Followed https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-windows )

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

To open a SSPR session, you will need to make sure that the user has the appropriate rights. These rights can be configured through the Local Security Policy on the Windows 10 machine. The rights you need to enable are: Change Password, Force Password Change on Logon, and Set Password. Additionally, you will need to make sure that the user is allowed to logon locally, as well as have rights to the SSPR service itself. Lastly, you will need to ensure that the user is able to authenticate with the associated authentication provider. Once all of these rights are set, the user should be able to open a SSPR session.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

Answer 2

Double post

Answer 3

After varous tests, i have concluded that the option "Prevent non-admin users from installing packaged Windows apps" need to be desactivated.

I don"t know why : SSPR is a packaged indows app ?