Custom Solution: Active Directory Workstation Logons (Part 1) – Policy-Based Access Automation

Category

SystemIdentity Services

Content Type

Custom Solution

Vendors

Products

Windows Windows Server

Versions

WIN-11-ENTWS-2025-STD

Related Technologies

Active Directory (AD)Group Policy PowerShell Task Scheduler

AI Preview

Is this content worth your time? Use the quick preview to decide.

Welcome to Techaptic!

In this custom solution, we build a centralized way to control which users or security groups can sign in locally to specific Active Directory-joined workstations. Instead of creating separate GPOs for each user or computer, the policy state and allowed principals are stored on computer objects through custom Active Directory attributes and managed with a PowerShell-based admin console.

On the client side, a GPO-deployed startup script installs a scheduled task that periodically reads the latest settings from Active Directory, keeps a local policy cache and recovery baseline, and applies the required Allow log on locally configuration. We also verify the scheduled synchronization process, test denied and support-group sign-ins, remove previous access, and demonstrate the rebaseline mode used for exceptional recovery scenarios.

🔗 Helpful Links

There are no helpful links in this one.

Video Tutorial

Used Commands

Refresh ADUC Schema Cache

Get-Process mmc -ErrorAction SilentlyContinue | Stop-Process -Force

$UserCache = "$env:LOCALAPPDATAMicrosoftWindowsSchCache"

if (Test-Path $UserCache) {
Rename-Item `
-Path $UserCache `
-NewName ("SchCache.backup-{0}" -f (Get-Date -Format 'yyyyMMdd-HHmmss'))
}

Deploy Workstation Access Engine

<#
.SYNOPSIS
Techaptic - Workstation Access Engine

.DESCRIPTION
This Techaptic script manages local interactive logon access on domain-joined Windows
workstations by reading two custom Active Directory computer attributes:

- techapticLogonPolicyEnabled
- techapticLogonPrincipals

The engine is designed to be deployed as a Group Policy PowerShell startup script.
Install mode copies the engine to the protected local Techaptic directory, captures the
pre-Techaptic Allow log on locally baseline when needed, creates the scheduled sync task,
and performs an initial synchronization.

Sync mode reads the current computer policy from Active Directory, resolves configured
users and security groups to SIDs, refreshes the local policy cache, and applies the
required SeInteractiveLogonRight state. If Active Directory cannot be reached, the engine
uses the last successfully cached policy.

Rebaseline mode explicitly replaces the stored baseline with the computer's current
Allow log on locally state. Rebaseline is blocked while the Techaptic workstation policy
is enabled.

.PARAMETER Mode
Install
Installs or repairs the local engine, protects the working directory, captures the
initial baseline if required, registers the scheduled sync task, and performs a sync.

Sync
Reads the current Active Directory policy and reconciles the local
SeInteractiveLogonRight state. This is the normal scheduled-task mode.

Rebaseline
Re-captures the current local SeInteractiveLogonRight state as the new baseline.
The Techaptic workstation policy must not be enabled.

.EXAMPLE
.Techaptic-Workstation-Access-Engine.ps1 -Mode Install

.EXAMPLE
.Techaptic-Workstation-Access-Engine.ps1 -Mode Sync

.EXAMPLE
.Techaptic-Workstation-Access-Engine.ps1 -Mode Rebaseline

.NOTES
Author : Techaptic
Maintainer : Techaptic
Script : Workstation Access Engine
Execution : Group Policy PowerShell Startup Script / LocalSystem scheduled task
Local Path : C:ProgramDataTechapticWorkstationAccessTechaptic-Workstation-Access-Engine.ps1
State Files : baseline.json, policy-cache.json, engine.log

IMPORTANT OPERATIONAL NOTES:
- Deploy this script only to the intended workstation computer OU.
- The engine manages the Windows "Allow log on locally" user right
(SeInteractiveLogonRight). Avoid competing GPO, MDM, or script configuration for the
same right.
- "Deny log on locally" takes precedence over "Allow log on locally" and should be reviewed
for conflicts.
- BUILTINAdministrators is always retained while the Techaptic policy is enabled.
- A successful transition from Enabled to Disabled/Not Set restores the captured baseline
once. While the policy remains disabled, Techaptic no longer continuously enforces that
baseline.
- The baseline preserves the exported SeInteractiveLogonRight entries so SID-based and
account-name entries can be restored without changing their security-template format.
- If Active Directory policy reading fails, the last successful local policy cache is used.
- If a current AD principal cannot be resolved, only a cached SID for that same current DN
may be reused. Principals removed from the current AD attribute are never resurrected from
an older cache.
#>

param(
[ValidateSet('Install','Sync','Rebaseline')]
[string]$Mode = 'Sync'
)

$ErrorActionPreference = 'Stop'
Set-StrictMode -Version 2.0

$WorkDir = 'C:ProgramDataTechapticWorkstationAccess'
$LocalScript = Join-Path $WorkDir 'Techaptic-Workstation-Access-Engine.ps1'
$LogFile = Join-Path $WorkDir 'engine.log'
$CacheFile = Join-Path $WorkDir 'policy-cache.json'
$BaselineFile = Join-Path $WorkDir 'baseline.json'
$SyncTaskName = 'Techaptic Workstation Access - Policy Sync'
$LegacyTempPrefix = 'Techaptic Workstation Access - Temporary - '
$SyncMinutes = 30
$MaxLogBytes = 5MB
$LogArchiveCount = 3
$MutexName = 'GlobalTechapticWorkstationAccessEngine'
$AdministratorsSid = 'S-1-5-32-544'
$LocalSystemSid = 'S-1-5-18'

$script:Mutex = $null
$script:MutexHeld = $false

function Assert-Elevated {
$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object System.Security.Principal.WindowsPrincipal($identity)
$isSystem = ($identity.User -and $identity.User.Value -eq $LocalSystemSid)
$isAdmin = $principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not ($isSystem -or $isAdmin)) {
throw 'The engine must run as LocalSystem or from an elevated administrator session.'
}
}

function Initialize-WorkDirectory {
New-Item -Path $WorkDir -ItemType Directory -Force | Out-Null
}

function Protect-WorkDirectory {
$acl = New-Object System.Security.AccessControl.DirectorySecurity
$acl.SetAccessRuleProtection($true, $false)

$systemSid = New-Object System.Security.Principal.SecurityIdentifier($LocalSystemSid)
$adminsSid = New-Object System.Security.Principal.SecurityIdentifier($AdministratorsSid)
$rights = [System.Security.AccessControl.FileSystemRights]::FullControl
$inherit = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
$propagation = [System.Security.AccessControl.PropagationFlags]::None
$allow = [System.Security.AccessControl.AccessControlType]::Allow

[void]$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($systemSid,$rights,$inherit,$propagation,$allow)))
[void]$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($adminsSid,$rights,$inherit,$propagation,$allow)))
$acl.SetOwner($adminsSid)
Set-Acl -Path $WorkDir -AclObject $acl
}

function Enter-EngineMutex {
$script:Mutex = New-Object System.Threading.Mutex($false, $MutexName)
try {
$script:MutexHeld = $script:Mutex.WaitOne([TimeSpan]::FromMinutes(2))
}
catch [System.Threading.AbandonedMutexException] {
$script:MutexHeld = $true
}
if (-not $script:MutexHeld) {
throw 'Another engine instance is still running.'
}
}

function Exit-EngineMutex {
if ($script:Mutex) {
if ($script:MutexHeld) {
try { $script:Mutex.ReleaseMutex() } catch { }
}
try { $script:Mutex.Dispose() } catch { }
}
}

function Rotate-LogIfNeeded {
if (-not (Test-Path $LogFile)) { return }
try {
if ((Get-Item $LogFile).Length -lt $MaxLogBytes) { return }
for ($i = $LogArchiveCount; $i -ge 1; $i--) {
$current = "$LogFile.$i"
if ($i -eq $LogArchiveCount) {
Remove-Item $current -Force -ErrorAction SilentlyContinue
}
elseif (Test-Path $current) {
Move-Item $current "$LogFile.$($i + 1)" -Force
}
}
Move-Item $LogFile "$LogFile.1" -Force
}
catch { }
}

function Write-Log {
param([Parameter(Mandatory)][string]$Message)

Rotate-LogIfNeeded
$line = '{0} [{1}] [{2}] {3}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss zzz'), $env:COMPUTERNAME, $Mode, $Message
Add-Content -Path $LogFile -Value $line -Encoding UTF8

$color = [ConsoleColor]::Gray
if ($Message -like 'ERROR:*') {
$color = [ConsoleColor]::Red
}
elseif ($Message -like 'WARNING:*') {
$color = [ConsoleColor]::Yellow
}
elseif (
$Message -like 'Applied *' -or
$Message -like 'Restored *' -or
$Message -like 'Captured *' -or
$Message -like 'Installed *' -or
$Message -like 'Registered *' -or
$Message -like '*completed successfully*'
) {
$color = [ConsoleColor]::Green
}

Write-Host $line -ForegroundColor $color
}

function Write-JsonAtomic {
param(
[Parameter(Mandatory)]$InputObject,
[Parameter(Mandatory)][string]$Path,
[int]$Depth = 6
)
$temp = Join-Path (Split-Path $Path -Parent) ('.{0}.{1}.tmp' -f (Split-Path $Path -Leaf), [guid]::NewGuid().ToString('N'))
try {
$InputObject | ConvertTo-Json -Depth $Depth | Set-Content -Path $temp -Encoding UTF8
if (Test-Path $Path) {
try { [System.IO.File]::Replace($temp, $Path, $null) }
catch {
Remove-Item $Path -Force
Move-Item $temp $Path -Force
}
}
else {
Move-Item $temp $Path -Force
}
}
finally {
Remove-Item $temp -Force -ErrorAction SilentlyContinue
}
}

function Close-Disposable {
param($Object)
if ($null -eq $Object) { return }
try {
if ($Object -is [System.DirectoryServices.DirectoryEntry]) {
try { $Object.Close() } catch { }
}
([System.IDisposable]$Object).Dispose()
}
catch { }
}

function Escape-LdapFilterValue {
param([Parameter(Mandatory)][string]$Value)
$Value.Replace('','5c').Replace('*','2a').Replace('(','28').Replace(')','29').Replace(([char]0).ToString(),'0')
}

function Convert-ToBoolean {
param($Value)
if ($Value -is [bool]) { return $Value }
return ([string]$Value).Trim().Equals('TRUE',[System.StringComparison]::OrdinalIgnoreCase)
}

function Get-PrincipalFromDn {
param([Parameter(Mandatory)][string]$DistinguishedName)
$entry = $null
try {
$entry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$DistinguishedName")
$entry.AuthenticationType = [System.DirectoryServices.AuthenticationTypes]::Secure
$entry.RefreshCache(@('objectSid','sAMAccountName'))
$sidBytes = [byte[]]$entry.Properties['objectSid'].Value
if (-not $sidBytes) { throw "objectSid is missing for $DistinguishedName" }
$sid = New-Object System.Security.Principal.SecurityIdentifier($sidBytes,0)
[pscustomobject]@{
DistinguishedName = $DistinguishedName
SamAccountName = [string]$entry.Properties['sAMAccountName'].Value
Sid = $sid.Value
ObjectClass = [string]$entry.SchemaClassName
}
}
finally {
Close-Disposable $entry
}
}

function Get-TechapticComputerPolicy {
$root = $null
$searchRoot = $null
$searcher = $null
try {
$root = New-Object System.DirectoryServices.DirectoryEntry('LDAP://RootDSE')
$root.AuthenticationType = [System.DirectoryServices.AuthenticationTypes]::Secure
$defaultNamingContext = [string]$root.Properties['defaultNamingContext'].Value
if ([string]::IsNullOrWhiteSpace($defaultNamingContext)) {
throw 'Unable to determine defaultNamingContext from RootDSE.'
}

$searchRoot = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$defaultNamingContext")
$searchRoot.AuthenticationType = [System.DirectoryServices.AuthenticationTypes]::Secure
$searcher = New-Object System.DirectoryServices.DirectorySearcher($searchRoot)
$sam = Escape-LdapFilterValue("$($env:COMPUTERNAME)`$")
$searcher.Filter = "(&(objectCategory=computer)(sAMAccountName=$sam))"
$searcher.PageSize = 1
@('distinguishedName','techapticLogonPolicyEnabled','techapticLogonPrincipals') |
ForEach-Object { [void]$searcher.PropertiesToLoad.Add($_) }

$result = $searcher.FindOne()
if (-not $result) {
throw "Computer object for $env:COMPUTERNAME was not found in Active Directory."
}

$p = $result.Properties
$enabled = $false
if ($p['techapticlogonpolicyenabled'].Count -gt 0) {
$enabled = Convert-ToBoolean $p['techapticlogonpolicyenabled'][0]
}

$principalDns = @()
if ($p['techapticlogonprincipals'].Count -gt 0) {
$principalDns = @($p['techapticlogonprincipals'] | ForEach-Object { [string]$_ })
}

[pscustomobject]@{
ComputerDn = [string]$p['distinguishedname'][0]
Enabled = $enabled
PrincipalDns = $principalDns
}
}
finally {
Close-Disposable $searcher
Close-Disposable $searchRoot
Close-Disposable $root
}
}

function Get-SeInteractiveLogonEntries {
$tmp = Join-Path $WorkDir ('rights-{0}.inf' -f [guid]::NewGuid().ToString('N'))
try {
& secedit.exe /export /cfg $tmp /areas USER_RIGHTS /quiet | Out-Null
if ($LASTEXITCODE -ne 0) { throw "secedit export failed with exit code $LASTEXITCODE" }

$line = Get-Content $tmp | Where-Object { $_ -match '^SeInteractiveLogonRights*=' } | Select-Object -First 1
if (-not $line) { return @() }

$value = ($line -split '=',2)[1].Trim()
if ([string]::IsNullOrWhiteSpace($value)) { return @() }

return @(
$value -split ',' |
ForEach-Object { $_.Trim() } |
Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
)
}
finally {
Remove-Item $tmp -Force -ErrorAction SilentlyContinue
}
}

function Convert-SeInteractiveLogonEntryToComparableValue {
param([Parameter(Mandatory)][string]$Entry)

$value = $Entry.Trim()
if ([string]::IsNullOrWhiteSpace($value)) { return $null }

if ($value.StartsWith('*')) {
$sidCandidate = $value.Substring(1)
if ($sidCandidate -match '^S-d-(?:d+-)*d+$') {
return $sidCandidate.ToUpperInvariant()
}

# A leading asterisk denotes a SID-form security-template entry. If the
# remaining value is not a SID, keep it distinct rather than treating it
# as an account name during comparison.
return ('RAW:{0}' -f $value.ToUpperInvariant())
}

if ($value -match '^S-d-(?:d+-)*d+$') {
return $value.ToUpperInvariant()
}

try {
$account = New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $value
$sid = $account.Translate([System.Security.Principal.SecurityIdentifier])
return $sid.Value.ToUpperInvariant()
}
catch {
return ('NAME:{0}' -f $value.ToUpperInvariant())
}
}

function Get-SeInteractiveLogonComparableValues {
param([Parameter(Mandatory)][string[]]$Entries)

$values = @()
foreach ($entry in @($Entries)) {
if ([string]::IsNullOrWhiteSpace([string]$entry)) { continue }
$comparable = Convert-SeInteractiveLogonEntryToComparableValue -Entry ([string]$entry)
if (-not [string]::IsNullOrWhiteSpace([string]$comparable)) {
$values += $comparable
}
}

return @($values | Sort-Object -Unique)
}

function Write-Baseline {
param(
[Parameter(Mandatory)][string[]]$Entries,
[switch]$ReplaceExisting
)

$cleanEntries = @(
$Entries |
ForEach-Object { ([string]$_).Trim() } |
Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
Select-Object -Unique
)

if ($cleanEntries.Count -eq 0) {
throw 'Refusing to save an empty SeInteractiveLogonRight baseline.'
}

if ((Test-Path $BaselineFile) -and $ReplaceExisting) {
$backup = '{0}.bak-{1}' -f $BaselineFile,(Get-Date -Format 'yyyyMMdd-HHmmss')
Copy-Item -Path $BaselineFile -Destination $backup -Force
Write-Log "Backed up previous baseline to $backup"
}

$baseline = [ordered]@{
SchemaVersion = 2
ComputerName = $env:COMPUTERNAME
CapturedUtc = [datetime]::UtcNow.ToString('o')
Entries = $cleanEntries
}

Write-JsonAtomic -InputObject $baseline -Path $BaselineFile -Depth 4
Write-Log "Captured baseline SeInteractiveLogonRight in $BaselineFile"
}

function Save-BaselineIfNeeded {
if (Test-Path $BaselineFile) {
try {
$existing = Get-Content $BaselineFile -Raw | ConvertFrom-Json
$computerProperty = $existing.PSObject.Properties['ComputerName']
if ($computerProperty -and $computerProperty.Value -and ([string]$computerProperty.Value -ne $env:COMPUTERNAME)) {
throw "Baseline belongs to '$($computerProperty.Value)', not '$env:COMPUTERNAME'."
}
}
catch {
throw "Existing baseline file is invalid or unsafe to use: $($_.Exception.Message)"
}
return
}

$entries = @(Get-SeInteractiveLogonEntries)
Write-Baseline -Entries $entries
}

function Apply-SeInteractiveLogonEntries {
param([Parameter(Mandatory)][string[]]$Entries)

$desiredEntries = @(
$Entries |
ForEach-Object { ([string]$_).Trim() } |
Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
Select-Object -Unique
)

if ($desiredEntries.Count -eq 0) {
throw 'Refusing to apply an empty SeInteractiveLogonRight.'
}

$currentEntries = @(Get-SeInteractiveLogonEntries)
$desiredComparable = @(Get-SeInteractiveLogonComparableValues -Entries $desiredEntries)
$currentComparable = @(Get-SeInteractiveLogonComparableValues -Entries $currentEntries)

$diff = @(Compare-Object -ReferenceObject $currentComparable -DifferenceObject $desiredComparable)
if ($diff.Count -eq 0) {
Write-Log ("SeInteractiveLogonRight already matches desired state ({0} entry/entries)." -f $desiredEntries.Count)
return
}

$id = [guid]::NewGuid().ToString('N')
$cfg = Join-Path $WorkDir "apply-rights-$id.inf"
$db = Join-Path $WorkDir "apply-rights-$id.sdb"
$entryText = $desiredEntries -join ','
$inf = @"
[Unicode]
Unicode=yes
[Version]
signature="`$CHICAGO`$"
Revision=1
[Privilege Rights]
SeInteractiveLogonRight = $entryText
"@

try {
Set-Content -Path $cfg -Value $inf -Encoding Unicode
& secedit.exe /configure /db $db /cfg $cfg /areas USER_RIGHTS /quiet | Out-Null
if ($LASTEXITCODE -ne 0) { throw "secedit configure failed with exit code $LASTEXITCODE" }

$actualEntries = @(Get-SeInteractiveLogonEntries)
$actualComparable = @(Get-SeInteractiveLogonComparableValues -Entries $actualEntries)
$verifyDiff = @(Compare-Object -ReferenceObject $actualComparable -DifferenceObject $desiredComparable)
if ($verifyDiff.Count -ne 0) {
throw 'SeInteractiveLogonRight verification failed after secedit configuration.'
}

Write-Log ("Applied and verified SeInteractiveLogonRight with {0} entry/entries." -f $desiredEntries.Count)
}
finally {
Get-ChildItem -LiteralPath $WorkDir -Force -ErrorAction SilentlyContinue |
Where-Object { $_.Name -like "apply-rights-$id*" } |
Remove-Item -Force -ErrorAction SilentlyContinue
}
}

function Apply-SeInteractiveLogonRight {
param([Parameter(Mandatory)][string[]]$Sids)

$desiredSids = @($Sids | Where-Object { $_ } | Sort-Object -Unique)
if ($desiredSids.Count -eq 0) { throw 'Refusing to apply an empty SeInteractiveLogonRight.' }

foreach ($sid in $desiredSids) {
if ([string]$sid -notmatch '^S-d-(?:d+-)*d+$') {
throw "Invalid SID supplied for Techaptic-managed SeInteractiveLogonRight: $sid"
}
}

$entries = @($desiredSids | ForEach-Object { "*$_" })
Apply-SeInteractiveLogonEntries -Entries $entries
}

function Restore-Baseline {
if (-not (Test-Path $BaselineFile)) {
Write-Log 'Policy disabled, but no baseline exists. No local change made.'
return
}

$baseline = Get-Content $BaselineFile -Raw | ConvertFrom-Json
$computerProperty = $baseline.PSObject.Properties['ComputerName']
if ($computerProperty -and $computerProperty.Value -and ([string]$computerProperty.Value -ne $env:COMPUTERNAME)) {
throw "Refusing to restore baseline captured for '$($computerProperty.Value)' on '$env:COMPUTERNAME'."
}

$entries = @()
$entriesProperty = $baseline.PSObject.Properties['Entries']

if ($entriesProperty) {
$entries = @($entriesProperty.Value)
}
else {
# Backward compatibility for baselines created by the earlier engine.
# The old property was named "Sids", but secedit can export account-name
# entries as well. Preserve names as names and add '*' only to real SIDs.
$legacySidsProperty = $baseline.PSObject.Properties['Sids']
if ($legacySidsProperty) {
foreach ($item in @($legacySidsProperty.Value)) {
$value = ([string]$item).Trim()
if ([string]::IsNullOrWhiteSpace($value)) { continue }

if ($value.StartsWith('*')) {
$entries += $value
}
elseif ($value -match '^S-d-(?:d+-)*d+$') {
$entries += "*$value"
}
else {
$entries += $value
}
}
}
}

if ($entries.Count -eq 0) {
throw 'Baseline entry list is empty. Refusing to restore.'
}

Apply-SeInteractiveLogonEntries -Entries $entries
Write-Log 'Restored and verified baseline SeInteractiveLogonRight.'
}

function Load-Cache {
if (-not (Test-Path $CacheFile)) { return $null }
try { $cache = Get-Content $CacheFile -Raw | ConvertFrom-Json }
catch { throw "Local policy cache is unreadable: $($_.Exception.Message)" }

$computerProperty = $cache.PSObject.Properties['ComputerName']
if ($computerProperty -and $computerProperty.Value -and ([string]$computerProperty.Value -ne $env:COMPUTERNAME)) {
throw "Local policy cache belongs to '$($computerProperty.Value)', not '$env:COMPUTERNAME'."
}
return $cache
}

function Get-CachedPrincipalForDn {
param(
$Cache,
[Parameter(Mandatory)][string]$DistinguishedName
)

if ($null -eq $Cache) { return $null }

foreach ($principal in @($Cache.PermanentPrincipals)) {
if ($null -eq $principal) { continue }

$dnProperty = $principal.PSObject.Properties['DistinguishedName']
$sidProperty = $principal.PSObject.Properties['Sid']
if (-not $dnProperty -or -not $sidProperty) { continue }

$cachedDn = [string]$dnProperty.Value
$cachedSid = [string]$sidProperty.Value
if (
-not [string]::IsNullOrWhiteSpace($cachedDn) -and
-not [string]::IsNullOrWhiteSpace($cachedSid) -and
$cachedDn.Equals($DistinguishedName,[System.StringComparison]::OrdinalIgnoreCase)
) {
return $principal
}
}

return $null
}

function Get-EffectiveSidsFromCache {
param([Parameter(Mandatory)]$Cache)
$sids = @($AdministratorsSid)
foreach ($p in @($Cache.PermanentPrincipals)) {
if ($p.Sid) { $sids += [string]$p.Sid }
}
return @($sids | Sort-Object -Unique)
}

function Reconcile-FromCache {
$cache = Load-Cache
if (-not $cache) {
Write-Log 'No local policy cache exists. No local changes made.'
return
}

if (-not [bool]$cache.PolicyEnabled) {
Write-Log 'Cached policy is disabled. Techaptic is not managing SeInteractiveLogonRight.'
return
}

Apply-SeInteractiveLogonRight -Sids (Get-EffectiveSidsFromCache -Cache $cache)
}

function Get-NextHalfHourSlot {
$now = Get-Date
$hour = $now.Date.AddHours($now.Hour)
if ($now.Minute -lt 30) { return $hour.AddMinutes(30) }
return $hour.AddHours(1)
}

function Get-TaskPrincipal {
New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
}

function Get-TaskSettings {
New-ScheduledTaskSettingsSet `
-StartWhenAvailable `
-AllowStartIfOnBatteries `
-DontStopIfGoingOnBatteries `
-MultipleInstances IgnoreNew `
-ExecutionTimeLimit (New-TimeSpan -Minutes 5)
}

function Register-SyncTask {
$next = Get-NextHalfHourSlot
$repeat = New-ScheduledTaskTrigger -Once -At $next -RepetitionInterval (New-TimeSpan -Minutes $SyncMinutes) -RepetitionDuration (New-TimeSpan -Days 3650)
$startup = New-ScheduledTaskTrigger -AtStartup
$ps = "$env:SystemRootSystem32WindowsPowerShellv1.0powershell.exe"
$action = New-ScheduledTaskAction -Execute $ps -Argument "-NoProfile -NonInteractive -File `"$LocalScript`" -Mode Sync"

Register-ScheduledTask `
-TaskName $SyncTaskName `
-Action $action `
-Trigger @($startup,$repeat) `
-Principal (Get-TaskPrincipal) `
-Settings (Get-TaskSettings) `
-Description "Techaptic assigned-workstation policy sync. Startup + :00/:30." `
-Force | Out-Null

Write-Log ("Registered policy sync task. Next clock-aligned sync: {0}" -f $next)
}

function Remove-LegacyTemporaryTasks {
$removed = 0
foreach ($suffix in @('Start','Warn15','Warn5','Expire','HardLogoff')) {
$name = $LegacyTempPrefix + $suffix
if (Get-ScheduledTask -TaskName $name -ErrorAction SilentlyContinue) {
Unregister-ScheduledTask -TaskName $name -Confirm:$false -ErrorAction SilentlyContinue
$removed++
}
}
if ($removed -gt 0) {
Write-Log "Removed $removed legacy temporary-access scheduled task(s)."
}
}

function Invoke-Sync {
Save-BaselineIfNeeded
Remove-LegacyTemporaryTasks

try {
$policy = Get-TechapticComputerPolicy
}
catch {
Write-Log ("WARNING: AD policy read failed: {0}. Falling back to the last successful local cache." -f $_.Exception.Message)
Reconcile-FromCache
return
}

$previousCache = $null
try {
$previousCache = Load-Cache
}
catch {
Write-Log ("WARNING: Existing local policy cache could not be read and will not be used for principal fallback: {0}" -f $_.Exception.Message)
}

if (-not $policy.Enabled) {
$wasPreviouslyEnabled = $false
if ($null -ne $previousCache) {
$enabledProperty = $previousCache.PSObject.Properties['PolicyEnabled']
if ($enabledProperty) {
$wasPreviouslyEnabled = [bool]$enabledProperty.Value
}
}

if ($wasPreviouslyEnabled) {
Restore-Baseline
Write-Log 'Policy transitioned to disabled. Baseline restored once.'
}
else {
Write-Log 'Policy is disabled. Techaptic is not managing SeInteractiveLogonRight.'
}

$cache = [ordered]@{
SchemaVersion = 1
ComputerName = $env:COMPUTERNAME
ComputerDn = $policy.ComputerDn
LastSuccessfulSyncUtc = [datetime]::UtcNow.ToString('o')
PolicyEnabled = $false
PermanentPrincipals = @()
}
Write-JsonAtomic -InputObject $cache -Path $CacheFile -Depth 5
Write-Log "Policy cache updated: $CacheFile"
return
}

$principals = @()
foreach ($dn in @($policy.PrincipalDns)) {
try {
$principal = Get-PrincipalFromDn -DistinguishedName $dn
$principals += $principal
Write-Log ("Allowed principal resolved: {0} ({1}) -> {2}" -f $principal.SamAccountName,$principal.ObjectClass,$principal.Sid)
}
catch {
$cachedPrincipal = Get-CachedPrincipalForDn -Cache $previousCache -DistinguishedName $dn
if ($null -ne $cachedPrincipal) {
$principals += $cachedPrincipal
Write-Log ("WARNING: Current principal DN could not be resolved from AD; reusing the cached SID only for the same current DN: {0} -> {1}" -f $dn,[string]$cachedPrincipal.Sid)
}
else {
Write-Log ("WARNING: Current principal DN could not be resolved and no same-DN cached SID exists. The principal will not be applied during this sync: {0}. Error: {1}" -f $dn,$_.Exception.Message)
}
}
}

if ($principals.Count -eq 0) {
Write-Log 'WARNING: Policy is enabled with no resolved principals. Only BUILTINAdministrators will retain local interactive logon.'
}

$cache = [ordered]@{
SchemaVersion = 1
ComputerName = $env:COMPUTERNAME
ComputerDn = $policy.ComputerDn
LastSuccessfulSyncUtc = [datetime]::UtcNow.ToString('o')
PolicyEnabled = $true
PermanentPrincipals = @($principals)
}

Write-JsonAtomic -InputObject $cache -Path $CacheFile -Depth 6
Write-Log "Policy cache updated: $CacheFile"
Reconcile-FromCache
Write-Log 'AD policy sync completed successfully.'
}

function Invoke-Rebaseline {
$policy = Get-TechapticComputerPolicy
if ($policy.Enabled) {
throw 'Rebaseline is blocked while Techaptic workstation policy is enabled. Run Rebaseline only while the policy is disabled or not set.'
}

$entries = @(Get-SeInteractiveLogonEntries)
Write-Baseline -Entries $entries -ReplaceExisting
Write-Log 'Baseline was explicitly re-captured while Techaptic policy was disabled.'
}

function Invoke-Install {
if ($PSCommandPath -ne $LocalScript) {
Copy-Item -Path $PSCommandPath -Destination $LocalScript -Force
Unblock-File -Path $LocalScript -ErrorAction SilentlyContinue
Write-Log "Installed engine locally to $LocalScript"
}
else {
Write-Log "Engine install/repair invoked from local path."
}

Protect-WorkDirectory
Save-BaselineIfNeeded
Remove-LegacyTemporaryTasks
Register-SyncTask
Invoke-Sync
}

$exitCode = 0
try {
Assert-Elevated
Initialize-WorkDirectory
Protect-WorkDirectory
Enter-EngineMutex

switch ($Mode) {
'Install' { Invoke-Install }
'Sync' { Invoke-Sync }
'Rebaseline' { Invoke-Rebaseline }
}
}
catch {
try { Write-Log ("ERROR: {0}" -f $_.Exception.Message) }
catch { Write-Error $_.Exception.Message }
$exitCode = 1
}
finally {
Exit-EngineMutex
}

exit $exitCode

Manage Local Sign-In Access

<#
.SYNOPSIS
Techaptic - Workstation Access Admin Console

.DESCRIPTION
This Techaptic administration console manages workstation sign-in assignments stored in
Active Directory computer objects.

The console works with these custom Active Directory attributes:

- techapticLogonPolicyEnabled
- techapticLogonPrincipals

It provides an interactive interface for checking the current workstation-access state,
enabling or disabling the Techaptic workstation policy, and adding or removing allowed
Active Directory principals.

User and security-group input is resolved automatically to the required Active Directory
distinguished name before it is stored on the computer object. The console accepts users
and security-enabled groups only.

This console changes Active Directory policy data only. It does not push changes directly
to client computers. Endpoints apply the current policy through the Techaptic Workstation
Access Engine at startup or during the scheduled synchronization cycle.

.REQUIREMENTS
- Windows PowerShell with the ActiveDirectory module available.
- Sufficient Active Directory permissions to read and modify the Techaptic custom
attributes on the target computer objects.
- The Techaptic schema attributes must already exist and be available on the computer class.
- The Techaptic Workstation Access Engine must be deployed to the intended endpoints for
policy enforcement.

.OPERATION
Status
Shows whether the Techaptic workstation policy is Enabled, Disabled, or Not set and
lists the principals currently stored on the selected computer object.

Enable Policy
Sets techapticLogonPolicyEnabled to TRUE for the selected computer. If no principals
are configured, the console requires explicit confirmation because the endpoint engine
will retain only BUILTINAdministrators for local interactive logon.

Disable Policy
Sets techapticLogonPolicyEnabled to FALSE. The endpoint engine handles the corresponding
local policy transition during its next successful synchronization.

Add Allowed Principal
Resolves an Active Directory user or security-enabled group and stores its distinguished
name in techapticLogonPrincipals.

Remove Allowed Principal
Removes one selected distinguished name from techapticLogonPrincipals.

Clear All Allowed Principals
Removes all configured principals from the selected computer object. If the policy is
enabled, the console warns that only BUILTINAdministrators will remain after endpoint
synchronization.

.NOTES
Author : Techaptic
Maintainer : Techaptic
Script : Workstation Access Admin Console
Execution : Interactive administrative PowerShell session

IMPORTANT OPERATIONAL NOTES:
- Run the console with an account that has the required Active Directory permissions.
- This console manages Active Directory configuration only; it does not directly modify the
local "Allow log on locally" setting on endpoints.
- Endpoint changes are applied by the Techaptic Workstation Access Engine at startup or the
next scheduled synchronization.
- Only Active Directory users and security-enabled groups are accepted as allowed principals.
- Disabling the policy does not delete stored principal assignments from Active Directory;
they remain stored but inactive until the policy is enabled again.
- Review "Deny log on locally" and any other GPO, MDM, or script that can conflict with local
interactive logon rights on the managed endpoints.
#>

$ErrorActionPreference = 'Stop'
Set-StrictMode -Version 2.0

Import-Module ActiveDirectory -ErrorAction Stop

$PolicyAttribute = 'techapticLogonPolicyEnabled'
$PrincipalsAttribute = 'techapticLogonPrincipals'

function Write-Rule {
param([ConsoleColor]$Color = [ConsoleColor]::DarkGray)
Write-Host ('-' * 68) -ForegroundColor $Color
}

function Write-Title {
Clear-Host
Write-Host ('=' * 68) -ForegroundColor Cyan
Write-Host ' TECHAPTIC WORKSTATION ACCESS' -ForegroundColor Cyan
Write-Host ' Admin Console' -ForegroundColor DarkCyan
Write-Host ('=' * 68) -ForegroundColor Cyan
Write-Host 'Principal = Active Directory user or security group' -ForegroundColor DarkGray
Write-Host 'AD changes apply on the endpoint at startup or the next :00/:30 sync.' -ForegroundColor DarkGray
Write-Host 'User/group input is resolved to the required AD distinguished name automatically.' -ForegroundColor DarkGray
Write-Host 'At an input prompt, press Enter twice to return to the main menu.' -ForegroundColor DarkGray
Write-Host ''
}

function Write-Section {
param([Parameter(Mandatory)][string]$Text)
Write-Host ''
Write-Host ("[ {0} ]" -f $Text) -ForegroundColor Cyan
}

function Write-Success {
param([Parameter(Mandatory)][string]$Text)
Write-Host $Text -ForegroundColor Green
}

function Write-WarningText {
param([Parameter(Mandatory)][string]$Text)
Write-Host $Text -ForegroundColor Yellow
}

function Write-ErrorText {
param([Parameter(Mandatory)][string]$Text)
Write-Host ("ERROR: {0}" -f $Text) -ForegroundColor Red
}

function Wait-ForMenu {
Write-Host ''
Write-Rule
[void](Read-Host 'Press Enter to return to the main menu')
}

function Escape-LdapFilterValue {
param([Parameter(Mandatory)][string]$Value)
$Value.Replace('','5c').Replace('*','2a').Replace('(','28').Replace(')','29').Replace(([char]0).ToString(),'0')
}

function Confirm-DefaultYes {
param([Parameter(Mandatory)][string]$Prompt)
while ($true) {
Write-Host -NoNewline ("{0} [Y/n]: " -f $Prompt) -ForegroundColor Yellow
$answer = (Read-Host).Trim()
if ([string]::IsNullOrWhiteSpace($answer) -or $answer -match '^(?i:y|yes)$') { return $true }
if ($answer -match '^(?i:n|no)$') { return $false }
Write-WarningText 'Please enter Y or N.'
}
}

function Confirm-DefaultNo {
param([Parameter(Mandatory)][string]$Prompt)
while ($true) {
Write-Host -NoNewline ("{0} [y/N]: " -f $Prompt) -ForegroundColor Yellow
$answer = (Read-Host).Trim()
if ([string]::IsNullOrWhiteSpace($answer) -or $answer -match '^(?i:n|no)$') { return $false }
if ($answer -match '^(?i:y|yes)$') { return $true }
Write-WarningText 'Please enter Y or N.'
}
}

function Request-MainMenu {
if (Confirm-DefaultYes 'Return to the main menu?') {
throw [System.OperationCanceledException]::new('ReturnToMainMenu')
}
}

function Read-InputOrBack {
param([Parameter(Mandatory)][string]$Prompt)
while ($true) {
Write-Host -NoNewline ("{0}: " -f $Prompt) -ForegroundColor Yellow
$value = (Read-Host).Trim()
if (-not [string]::IsNullOrWhiteSpace($value)) { return $value }
Request-MainMenu
}
}

function Resolve-Computer {
param([Parameter(Mandatory)][string]$InputValue)
$escaped = Escape-LdapFilterValue $InputValue.Trim().TrimEnd('$')
$matches = @(Get-ADComputer -LDAPFilter "(|(name=$escaped)(sAMAccountName=$escaped`$))" -Properties $PolicyAttribute,$PrincipalsAttribute)
if ($matches.Count -eq 0) { throw "Computer '$InputValue' was not found." }
if ($matches.Count -gt 1) { throw "Computer '$InputValue' is ambiguous." }
return $matches[0]
}

function Resolve-Principal {
param([Parameter(Mandatory)][string]$InputValue)
$escaped = Escape-LdapFilterValue $InputValue.Trim()
$filter = "(|(&(objectCategory=person)(objectClass=user)(|(sAMAccountName=$escaped)(userPrincipalName=$escaped)(displayName=$escaped)(name=$escaped)))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=2147483648)(|(sAMAccountName=$escaped)(displayName=$escaped)(name=$escaped))))"
$matches = @(Get-ADObject -LDAPFilter $filter -Properties sAMAccountName,displayName,objectClass)

if ($matches.Count -eq 0) { throw "User or security group '$InputValue' was not found." }
if ($matches.Count -eq 1) { return $matches[0] }

Write-Section 'MULTIPLE MATCHES'
for ($i = 0; $i -lt $matches.Count; $i++) {
Write-Host ('[{0}] {1} [{2}] ({3})' -f ($i + 1),$matches[$i].Name,$matches[$i].ObjectClass,$matches[$i].sAMAccountName)
Write-Host (' {0}' -f $matches[$i].DistinguishedName) -ForegroundColor DarkGray
}

while ($true) {
$choice = Read-InputOrBack 'Select a number'
$number = 0
if ([int]::TryParse($choice,[ref]$number) -and $number -ge 1 -and $number -le $matches.Count) {
return $matches[$number - 1]
}
Write-WarningText 'Invalid selection.'
}
}

function Get-ConfiguredDns {
param([Parameter(Mandatory)]$Computer)
$value = $Computer.$PrincipalsAttribute
if ($null -eq $value) { return @() }

$result = New-Object System.Collections.Generic.List[string]
foreach ($item in @($value)) {
if ($null -ne $item) {
$text = [string]$item
if (-not [string]::IsNullOrWhiteSpace($text)) { $result.Add($text) }
}
}
return @($result.ToArray())
}

function Get-FreshComputer {
param([Parameter(Mandatory)]$Computer)
return Get-ADComputer -Identity $Computer.DistinguishedName -Properties $PolicyAttribute,$PrincipalsAttribute
}

function Show-ComputerState {
param([Parameter(Mandatory)]$Computer)
$fresh = Get-FreshComputer $Computer
$rawPolicy = $fresh.$PolicyAttribute
$policyState = if ($null -eq $rawPolicy) { 'Not set' } elseif ([bool]$rawPolicy) { 'Enabled' } else { 'Disabled' }

Write-Section 'CURRENT WORKSTATION ACCESS'
Write-Host -NoNewline 'Computer : ' -ForegroundColor DarkGray
Write-Host $fresh.Name -ForegroundColor White
Write-Host -NoNewline 'Policy : ' -ForegroundColor DarkGray

switch ($policyState) {
'Enabled' { Write-Host 'Enabled' -ForegroundColor Green }
'Disabled' { Write-Host 'Disabled' -ForegroundColor Red }
'Not set' { Write-Host 'Not set' -ForegroundColor Yellow }
}

Write-Host 'Configured principals:' -ForegroundColor DarkGray
$dns = @(Get-ConfiguredDns $fresh)

if ($policyState -ne 'Enabled' -and $dns.Count -gt 0) {
Write-Host ' Note: these assignments are stored in AD but are inactive while the policy is not enabled.' -ForegroundColor Yellow
}

if ($dns.Count -eq 0) {
Write-WarningText ' (none)'
if ($policyState -eq 'Enabled') {
Write-WarningText ' Policy is enabled: only BUILTINAdministrators will retain local interactive logon.'
}
return
}

foreach ($dn in $dns) {
try {
$obj = Get-ADObject -Identity $dn -Properties sAMAccountName,objectClass
$type = if ($obj.ObjectClass -eq 'group') { 'security group' } else { 'user' }
Write-Host (' - {0} [{1}] ({2})' -f $obj.Name,$type,$obj.sAMAccountName) -ForegroundColor White
}
catch {
Write-Host (' - UNRESOLVED: {0}' -f $dn) -ForegroundColor Red
}
}
}

function Select-Computer {
$name = Read-InputOrBack 'Computer name'
return Resolve-Computer $name
}

function Add-Principal {
Write-Section 'ADD ALLOWED PRINCIPAL'
$computer = Select-Computer
$inputValue = Read-InputOrBack 'AD user or security group (name, sAMAccountName, UPN, or display name)'
$principal = Resolve-Principal $inputValue

$fresh = Get-FreshComputer $computer
$current = @(Get-ConfiguredDns $fresh)
$principalDn = [string]$principal.DistinguishedName

if ($current -contains $principalDn) {
Write-WarningText 'That principal is already configured.'
Show-ComputerState $computer
return
}

Set-ADComputer -Identity $computer.DistinguishedName -Add @{ $PrincipalsAttribute = $principalDn }
Write-Success ("Added '{0}' to '{1}'." -f $principal.Name,$computer.Name)
Show-ComputerState $computer
}

function Remove-Principal {
Write-Section 'REMOVE ALLOWED PRINCIPAL'
$computer = Select-Computer
$fresh = Get-FreshComputer $computer
$current = @(Get-ConfiguredDns $fresh)

if ($current.Count -eq 0) {
Write-WarningText 'No configured principals exist.'
return
}

Write-Host ''
for ($i = 0; $i -lt $current.Count; $i++) {
try {
$obj = Get-ADObject -Identity $current[$i] -Properties sAMAccountName,objectClass
$type = if ($obj.ObjectClass -eq 'group') { 'security group' } else { 'user' }
$label = '{0} [{1}] ({2})' -f $obj.Name,$type,$obj.sAMAccountName
}
catch { $label = 'UNRESOLVED: {0}' -f $current[$i] }
Write-Host ('[{0}] {1}' -f ($i + 1),$label)
}

while ($true) {
$choice = Read-InputOrBack 'Principal number to remove'
$number = 0
if ([int]::TryParse($choice,[ref]$number) -and $number -ge 1 -and $number -le $current.Count) { break }
Write-WarningText 'Invalid selection.'
}

$dnToRemove = [string]$current[$number - 1]
Set-ADComputer -Identity $computer.DistinguishedName -Remove @{ $PrincipalsAttribute = $dnToRemove }
Write-Success 'Principal removed.'
Show-ComputerState $computer
}

function Set-PolicyState {
param([Parameter(Mandatory)][bool]$Enabled)
Write-Section $(if ($Enabled) { 'ENABLE POLICY' } else { 'DISABLE POLICY' })
$computer = Select-Computer

if ($Enabled) {
$fresh = Get-FreshComputer $computer
$current = @(Get-ConfiguredDns $fresh)
if ($current.Count -eq 0) {
Write-WarningText 'No allowed principals are configured.'
Write-WarningText 'If enabled, only BUILTINAdministrators will retain local interactive logon.'
$confirm = Read-InputOrBack 'Type ENABLE to continue'
if ($confirm -cne 'ENABLE') {
Write-WarningText 'Policy was not enabled.'
return
}
}
}

Set-ADComputer -Identity $computer.DistinguishedName -Replace @{ $PolicyAttribute = $Enabled }
Write-Success ("Policy {0} for '{1}'." -f $(if ($Enabled) { 'enabled' } else { 'disabled' }),$computer.Name)
Show-ComputerState $computer
}

function Clear-Principals {
Write-Section 'CLEAR ALL ALLOWED PRINCIPALS'
$computer = Select-Computer
$fresh = Get-FreshComputer $computer
$enabled = if ($null -eq $fresh.$PolicyAttribute) { $false } else { [bool]$fresh.$PolicyAttribute }

if (@(Get-ConfiguredDns $fresh).Count -eq 0) {
Write-WarningText 'No configured principals exist.'
return
}

Write-WarningText ("This will remove every configured principal from '{0}'." -f $computer.Name)
if ($enabled) {
Write-WarningText 'Policy is enabled: after endpoint sync, only BUILTINAdministrators will retain local interactive logon.'
}

$confirm = Read-InputOrBack 'Type YES to continue'
if ($confirm -cne 'YES') {
Write-WarningText 'No principals were removed.'
return
}

Set-ADComputer -Identity $computer.DistinguishedName -Clear $PrincipalsAttribute
Write-Success 'All configured principals were cleared.'
Show-ComputerState $computer
}

function Show-Menu {
Write-Title
Write-Host 'STATUS' -ForegroundColor DarkCyan
Write-Host ' 1 Show workstation access'
Write-Host ''
Write-Host 'POLICY' -ForegroundColor DarkCyan
Write-Host ' 2 Enable policy'
Write-Host ' 3 Disable policy'
Write-Host ''
Write-Host 'ASSIGNMENTS' -ForegroundColor DarkCyan
Write-Host ' 4 Add allowed principal (user/security group)'
Write-Host ' 5 Remove allowed principal'
Write-Host ' 6 Clear all allowed principals'
Write-Host ''
Write-Rule
Write-Host ' 0 Exit'
Write-Rule
}

while ($true) {
Show-Menu
Write-Host -NoNewline 'Select: ' -ForegroundColor Yellow
$selection = (Read-Host).Trim()

if ($selection -eq '0') {
if (Confirm-DefaultNo 'Exit Techaptic Workstation Access?') {
Write-Host 'Exiting Techaptic Workstation Access.' -ForegroundColor DarkGray
return
}
continue
}

if ([string]::IsNullOrWhiteSpace($selection)) { continue }

$skipPause = $false
try {
switch ($selection) {
'1' { Write-Section 'SHOW WORKSTATION ACCESS'; Show-ComputerState (Select-Computer) }
'2' { Set-PolicyState -Enabled $true }
'3' { Set-PolicyState -Enabled $false }
'4' { Add-Principal }
'5' { Remove-Principal }
'6' { Clear-Principals }
default { Write-WarningText 'Invalid selection.' }
}
}
catch [System.OperationCanceledException] { $skipPause = $true }
catch { Write-ErrorText $_.Exception.Message }

if (-not $skipPause) { Wait-ForMenu }
}

Full Transcript

Click to see...

Introduction and Solution Overview

Hello and welcome to the Techaptic channel. Today we are going to configure, step by step, a solution that lets us centrally manage which users can sign in to which computers in our Active Directory environments. As you know, with the default Group Policy settings, domain users can generally sign in locally to any workstation. This may be acceptable in some environments, but restricting this can be a better choice for reasons such as improving data security, preventing unnecessary disk usage, or stopping user data from spreading across different computers. So, if we are assigning a computer to a user, with this solution, we can also have better control over who can use that computer and the user data stored on it.

Of course, in some companies, support teams may also need to sign in to computers. So, with these settings, we can allow multiple users or group accounts to sign in when needed, while also taking those support teams into account. Of course, one of the important points here is how this structure will work when the computer cannot communicate with the Active Directory. So, to make these gray areas clear and better understand the solution we are going to apply, let’s briefly go over how the structure works using the diagram on the screen. The design is actually quite simple.

We will manage local sign-in access through Active Directory. With the help of the AI tools, we prepared a script for this. This script acts as an admin console and lets us perform the management tasks we need.

Architecture and Active Directory Attribute Design

The console is built around two custom attributes: techapticLogonPolicyEnabled and techapticLogonPrincipals. Once they are created in Active Directory and added to the computer class, the required actions are handled through the computer objects. So, we won’t create separate GPOs for different users or computers. Instead, we will keep the policy information on the computer objects. The techapticLogonPolicyEnabled attribute is Boolean, so it takes a true or false value and determines whether that computer is managed by this structure.

If we want the policy to be active, we set this value to true, but that alone is not enough. We We also need to specify the DN of the user or group accounts that should be able to sign in locally to that computer. These values are stored in the techapticLogonPrincipals attribute. In the Admin Console, however, we don’t enter DN values manually. Instead, we enter a user or group name and let the script save it in the required format.

However, simply creating and editing these two custom attributes is not enough for this scenario. The clients also need to read these settings and apply the required restriction. For that, we prepared a PowerShell script that runs a startup script through GPO. Based on the predefined settings, this script creates a scheduled task under Task Scheduler on the target computers. This task periodically reads the attributes on the client computer object and stores the current policy information in a local cache file.

If the current local setting is different, it applies the required change through the Allow log on locally setting. So we are not pushing the policies from the admin console to the clients. The scheduled task on the clients pulls the latest information from Active Directory, writes it to the cache, and applies the latest setting. This is important because the computer may not always be able to communicate with Active Directory. And keeping this information in the cache allows the client to access the latest information from Active Directory.

This allows the system to continue working properly in those situations. By the way, this check runs when the computer starts and then every 30 minutes. If you want, you can change the synchronization interval. Also, if a user is already sign-in when their sign-in right is removed, the script doesn’t take any extra action against that active session. The user can continue working and after they sign out or restart the computer, they will no longer be able to sign in.

We designed it this way on purpose because our goal is not to manage immediate access to computers. That is a separate scenario, more related to security and emergency situations. If you have that kind of requirement in your environment, you can also check out the article or video with a title includes Emergency Computer Isolation for Data Security.

Active Directory Schema and Custom Attribute Configuration

With that, let’s move on to the configuration. First. To create these two custom attributes, Active Directory needs to be prepared for schema extension. We already completed those preparations in our environment. And to keep this video from getting longer, we won’t cover them here.

So let’s go directly to creating the custom attributes. First, let’s open MMC and go to the Active Directory Schema. I generated a base OID beforehand. So let’s go to the Active Directory Schema snap-in. We will use it to create two custom attributes.

Let’s open the Attributes container. Right-click and select Create Attribute. So we will use it to create two custom attributes. Let’s go to the attributes, right-click it, and click Create Attributes. For the common name, enter techapticLogonPolicyEnabled.

And make sure the LDAP display name field also has the same value because our scripts reference the attributes by this name. In the Unique X500 Object ID, first enter the base OID. You can generate any one for this work. Or if your environment already has an organizational OID namespace, you can use that as well. I reserved the second branch for attributes.

So I am adding.2 at the end of it first. And because this is my first custom attribute in that branch, I will also add.1 at the end. We will set the syntax to boolean because we will use the attribute as a switch to determine whether the attribute will be added or not. We can save it like this without changing anything else. Now let’s move to the other attribute.

Again click Create Attribute. And now for the common name, type techapticLogonPrincipals. And adjust the X500 Object ID the same way as before. But this time, I will add.2 and.2 at the end of it. This attribute will store the DN information for the accounts that are allowed to sign in to the computer.

So we will change the syntax to distinguish name. And please make sure to check the checkbox next to the multivalued. And click OK. Now to make these attributes available on the computer objects, we need to add them to the computer class. To do that, go to the classes section and find the computer class first.

And click OK. Double click it. And then click the attributes. We will add these attributes under optional because they won’t be mandatory for the computer objects. Let’s find the attributes we created before and add them one by one.

And click OK. Before checking them, let’s click the reload schema at the top. Also even after a reload, Active Directory users and computers can sometimes keep the object reading all the information from its cache. So we will run a small PowerShell script to make sure the schema cache is refreshed. Let’s exit.

And open the Active Directory users and computers. Before checking them, from the view section, click the advanced features. And then let’s test the computer object for this matter. Go to the attributes editor. And let’s check if our…

Custom attributes are added. OK. As you can see, they are seen under the attribute editor. Let’s click OK.

GPO and Client Prerequisites

Now we can move on to configuring the Startup Script through the GPO. I will create a new GPO and link it to the specific Organizational Unit because I don’t want these settings to be active on every computer. Let’s go to this Organizational Unit and create a new GPO. We will call it Logon Access Management. Now edit the GPO.

Before configuring the Startup Script, we will make a few prerequisite checks. Let’s call it logon access management. Before configuring the startup script, we will make a few things to make sure the system works reliably. Right-click the GPO and select Edit. And from here, under computer configuration, go to the administrative templates.

And then system. And from there, go to the logon. Let’s expand it a little bit. OK. From this section, enable always wait for the network at computer startup and logon.

This gives us a more reliable startup process so the policy can be read and processed while the computer is connected to the active directory. Also please make sure the PowerShell execution policy configuration allows these scripts to run. I already configured this at the domain level in my environment but if this is missing in yours. You need to complete that configuration as well. And to keep this managed from one place and avoid conflicts, I also recommend making sure there isn’t another configuration in the environment that can interfere with these settings such as deny logon locally.

Deploy the Workstation Access Engine and Admin Console

With these checks complete, let’s configure our GPO Startup Script. From here, go to the PowerShell script section. First click show files. But before that, let’s create our script first. Let’s create our script first.

Here. You can also find these scripts in our website as well. Let’s call it Techaptic-Workstation-Access-Engine.ps1. Let’s open it and paste our PowerShell script and save it. Let’s copy this PowerShell script and paste it under the script startup section.

Let’s go. Let’s copy the full name. Go back to the groupOS object and click add and type the script name with its extension. Before saving, under the script parameters, type mod install. The install mod first copies the script to the required directory in the computer and creates the necessary cache structure.

It also creates a scheduled task. And configures it to run at defined intervals. Let’s go. Let’s run it. And it runs at defined intervals.

Click ok and save the settings. Now we can apply some sample policies to the computers and move on to testing the process. We mentioned that we have an admin console. So first let’s edit our server. Let me create another script under temp directory.

And call it Techaptic-Workstation-Access-Admin-Console.ps1. And let’s create a new script. We will save it as a PowerShell script. And let’s create a new script under temp directory. Now open the Admin Console script in PowerShell.

We can use the console to manage the workstation access settings. And let’s go. Let’s set the admin console. And change the extension again to ps1. And let’s open it.

And paste our script here. And save it. Let’s open a PowerShell and run this script with admin privileges. In our script, we added some prompts to make the console easier to use. It basically has three sections.

The status, the policy, and the assignments. The status section shows the policy status for the selected computer. Let’s test it for one computer. Let’s type 1 and for the computer name, let’s type VID-CLIENT02. As you can see, it shows the status of this computer.

It says the policy is not set and there are currently no allowed principals. To go back to the main menu, let’s enter. In the second section, we configure enabling or disabling the policy.

Configure Policy and Allowed Principals

Let’s enable this policy for the respective computer. Let’s type 2 and enter. For the computer name, let’s type our previous computer name. When we designed this structure, we made sure accounts in the local Administrators group could still sign in, so we wouldn’t accidentally lock ourselves out. And the console also shows that information.

To continue, let’s type enable and enter. Okay. It looks like the policy is not enabled for this computer. Let’s quickly verify it in our active directory. As you can see, techapticLogonPolicyEnabled attribute is set as true.

Now let’s configure who can sign in this computer. Go back to the admin console. Let’s press enter. And now we will use the fourth section, which will allow us to add principals. For the respective computer.

For the computer name, again, we are typing the same computer. For the active directory users or security groups, we will use the user name. Let’s type lab.user02 in our example. Okay. As you can see, the system also shows us a summary for that configure after the change.

So we can easily see that what we have configured. Let’s also verify this. Let’s also verify this configuration. As you can see, the system added the DN under the techapticLogonPrincipals attribute. So far, so good.

Let’s click okay. So what we have configured on this computer. First, we enabled this computer for this policy. And then we allowed lab.user02 and the accounts in the local Administrators group to sign in locally. But these settings are still only on the server side.

Because as we said earlier, these changes we make in the console are not automatically pushed to the client computers. Now let’s let the scheduled task on the client read these settings and apply them locally. VID-CLIENT02 has not received the startup script yet and has not pulled the sign-in settings. So let’s move on to the client. Run gpu update course and then restart the computer.

We will sign in as lab.user02. And that’s the expected behavior. Before testing other users, I want to make sure the settings were configured correctly on this computer.

Validate Client Sync, Cache and Recovery Baseline

First, let’s check the Task Scheduler. We need to run it with administrator rights to see the scheduled tasks. At the bottom, there is a task called Techaptic Workstation Access – Policy Sync. And this is because the startup script creates the respective tasks for this matter. Let’s open it.

We can see that the task runs as system. And it is configured to run every computer startup and also every 30 minutes. In the Actions section, we see a PowerShell script running from the Techaptic Workstation Access directory in Sync mode. This mode refreshes the current policy in the policy cache file after every successful Active Directory synchronization. If the computer cannot communicate with the Active Directory, it loses the latest policy stored in that file.

Now let’s go to the directory where these files are stored. As you can see, this directory is protected. So standard users cannot access it with the permissions we configured. But we can inspect the files with an authorized account. At the bottom, you can see a copy of the startup script as we mentioned before.

Above it, there is a policy-cache.json file. This is the file where the system stores the policy locally. The engine log file can be used for troubleshooting. The system writes many actions here, including Active Directory checks, Scheduled Task installation, and the synchronization operations. We also have a baseline file.

This stores the Allow log on locally policy state that existed before the script first ran on that computer. This way, when we disable the policy for that computer, the settings can safely return to their previous state. Of course, there is another possibility here. When the policy is applied to the computer for the first time, the settings that existed before our change may not be configured the way we expect. This can happen because of a previous PoC session, a manual change, or another configuration.

Since the system naturally uses the current state as its baseline, we added a third operating mode for these exceptional cases, Rebaseline. This mode first checks whether the policy is active for that computer in Active Directory. If it is not active, it writes the current Allow log on locally setting to the baseline file as the new baseline. This lets us change the restore point for that computer and work around these exceptional cases, assuming that the new restore point has the settings we want. Rebaseline doesn’t run automatically at regular intervals like normal synchronization.

We only run it when we need it.

Test and Update Workstation Sign-In Access

Now, let’s check whether another user can sign in to this computer. Let’s close these windows. This time, let’s try lab.support01. As you can see, the system doesn’t allow us to sign in. Now, let’s assume lab.support01 account needs to provide support for this computer.

So, we will authorize the support group that contains this account for this specific machine. At the same time, to test removing access as well, we will also remove the lab.user02’s access. Let’s go back to the Active Directory. Let’s use this group account and check its members first. lab.support01 is under this group.

Let’s click OK. And go back to our admin console and grant this right. I intentionally entered the group name incorrectly here because the system, meaning the script, is designed to return error when it cannot find the account. When adding or removing entries here, we can only enter user accounts and security groups. I wanted to point out that as well.

Let’s go back to the main menu and go to the section 4 again. And now, let’s specify the right name. When I enter the correct name, the system makes the change and shows the summary below. Now, let’s remove access for lab.user02. For that, we will use the option 5 and enter the required information.

OK. As you can see, for the respective computer account, the policy is enabled and now only the GRP-WORKSTATION-SUPPORT account is granted for the Allow log on locally access. Now, let’s go back to the client. Instead of waiting 30 minutes for the system to pick up these things, let’s restart the computer. By the way, the 30-minute checks are triggered on the hour and at the half hour, which makes them easier to track for you.

The computer is back up. Now, let’s try signing in with lab.user02 first. This account can no longer sign in. Now, let’s try lab.support01. As you can see, the system allows this account to sign in, which we couldn’t do in our earlier attempts.

So, you can adapt these settings to your own environments to implement more controlled local sign-in management across client computers.

Outro

That’s the end of another video. See you in the next one. Take care.

Leave a comment on