How to setup/configure "Disable the local storage of passwords and credentials" using Intune?

Question

How to setup/configure "Disable the local storage of passwords and credentials" using Intune?

Vinod Survase 4,776

We have below recommendations in our tenant inside M365 Defender.

See below screenshot.

User's image

Lu Dai-MSFT 28,496 Reputation points

2023-06-12T05:26:31.2633333+00:00

@Vinod Sur Thanks for posting in our Q&A.

Based on my check, I didn't find that there is any built-in setting can make it. Sorry, there is no helpful information I can share with you.
Vinod Survase 4,776 Reputation points

2023-06-13T11:57:28.37+00:00

Thanks for reply @Lu Dai-MSFT

Hope someone from community can answer on this.
AR 0 Reputation points

2023-10-19T16:45:03.17+00:00

If the org-level M365 setting allows for a user's MFA credential to be retained for X number of days, am I correct in assuming that would be disallowed by disabling local storage? Or can both settings be used?

Not asking whether they should - asking what the technical capability is.

3 answers

Your answer

Lu Dai-MSFT 28,496 Reputation points

2023-06-12T05:26:31.2633333+00:00

@Vinod Sur Thanks for posting in our Q&A.

Based on my check, I didn't find that there is any built-in setting can make it. Sorry, there is no helpful information I can share with you.
Vinod Survase 4,776 Reputation points

2023-06-13T11:57:28.37+00:00

Thanks for reply @Lu Dai-MSFT

Hope someone from community can answer on this.
AR 0 Reputation points

2023-10-19T16:45:03.17+00:00

If the org-level M365 setting allows for a user's MFA credential to be retained for X number of days, am I correct in assuming that would be disallowed by disabling local storage? Or can both settings be used?

Not asking whether they should - asking what the technical capability is.

Answer 1

Thabiso Lowrence Morake 10

Here’s how you can disable the local storage of passwords and credentials with Intune:

Open the Microsoft Endpoint Manager admin center.
Select Devices > Configuration profiles > Create profile.
Enter a name and description for the profile.
Select Windows 10 and later as the platform.
Select Custom as the profile type.
Select Add > Oma-Uri settings.
Enter the following information:

Name: Enter a name for the setting.
Description: Enter a description for the setting.
Oma-Uri: ./Device/Vendor/MSFT/Policy/Config/Security/LocalAccounts/DisablePasswordStorage
Data type: Select Integer
Value: Enter 1

Save the profile.

netsys informat 5 Reputation points

2023-11-09T08:26:54.7866667+00:00

Hi,

I tried your solution and got an error code -2016281109 mean Data type conversion failed.

The value in the "name" line should not be specific?
georgeescott 0 Reputation points

2024-10-25T10:22:07.9866667+00:00

At the time of writing (October 2024) this isnt a valid CSP so this OMA-URI won't work.

You'll have to set it as a registry key via Win32app or Script.
Maciej Synowiec 15 Reputation points

2025-01-08T13:40:33.9066667+00:00

Check this
./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowStorageOfPasswordsAndCredentialsForNetworkAuthentication

Answer 2

Hey, this also got me! I have created my FIRST blog post! I hope this is helpfull.

https://open.substack.com/pub/mbcloudteck/p/hklmsystemcurrentcontrolsetcontrollsadisabledoma?r=2jeuoc&utm_campaign=post&utm_medium=web

Trying to make it to 100% within Microsoft Secure Score? Here is a common remediation item “Disable the local storage of passwords and credentials” under the “Accounts” category that Microsoft dose not give you an OOTB cloud only solution / recommendation to.

I will be attempting to create an Import Export JSON of a perfect set of Secure score settings for Win 10/11. So stay tuned. Here is piece 1/100!

Kind regards

Answer 3

Ahmed Saif Muntaseer 0

Through Network access: Do not allow storage of passwords and credentials for network authentication- you can set up.

This is important cause, If you aren't connected to the network, then you will not have cached creds to log in with.

Follow this article for Network access settings:

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication

Share via

How to setup/configure "Disable the local storage of passwords and credentials" using Intune?

3 answers

Your answer