Need to block Smart Lock/Smart Assist

Question

Hi,

Could you advise if there's a method to block or disable Smart Lock/Smart Assist features on the Lenovo T14 through SCCM or Intune by utilizing scripting? I'm exploring options to manage these functionalities centrally and would appreciate your insights on the most effective approach.

I've come across this article which is useful for manual , but it's more suitable for a single device. I need a method to apply this on a number of devices. Please suggest a solution...

https://support.lenovo.com/jp/en/solutions/HT515870

I have found this script but I'm not sure if it will work. Please suggest.

If this can be done via GPO, please suggest the GPO setting, but I would prefer the script more.

$getLenovoBIOS = gwmi -class Lenovo_SetBiosSetting -namespace root\wmi $getLenovoBIOS.SetBiosSetting("ZeroTouchLogin,Disable") $getLenovoBIOS.SetBiosSetting("ZeroTouchLock,Disable") $getLenovoBIOS.SetBiosSetting("ZeroTouchAllowOverride,Disable") $getLenovoBIOS.SetBiosSetting("PhysicalPresenceForTpmClear,Disable") $getLenovoBIOS.SetBiosSetting("UserPresenceSensing,Enable") (gwmi -class Lenovo_WmiOpcodeInterface -namespace root\wmi).WmiOpcodeInterface("WmiOpcodePasswordAdmin:YourBiosPasswordHereOrBlankIfNoPassword") (gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings()

image.png

image (1).png.

Answer 1

Unfortunately, directly disabling Smart Lock/Smart Assist through SCCM or Intune scripting on the Lenovo T14 isn't straightforward.

You can create a Group Policy Object (GPO) to disable Smart Lock/Smart Assist features.

• Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business.
• Configure the policies related to Windows Hello for Business according to your requirements.

Answer 2

Unfortunately, directly disabling Smart Lock/Smart Assist through SCCM or Intune scripting on the Lenovo T14 isn't straightforward.

You can create a PowerShell script to disable specific features related to Smart Lock/Smart Assist and then deploy it through SCCM or Intune.

Disable Smart Lock/Smart Assist features

Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowDomainPINLogon" -Value 0 -Type DWord Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowDomainPasswordLogon" -Value 0 -Type DWord