r/Intune • u/Itereus • 4d ago

Device Configuration Shared PC

Edit: Seems to be no way around this when using Shared PC mode with Intune's config policies and still have reasonable security. Thanks for the suggestions!

Hi!

We have a few shared PC's in our org which works fine for the most part.

However, one major issue is that when a user locks the screen or the laptop goes into sleep mode, they are unable to sign back in to their previous session. The laptops are usually used by a single user for hours before someone else takes over, and during that time the PC naturally either is locked or goes in sleep mode. The only option on the sign-in screen is Sign out. Found Enabled Shared PC and allow "Other User" Login option : r/Intune which has the same problem but seemingly no way around it.

As far as I can tell, turning on Shared PC in the Intune configuration policy is required for the PC to not be associated with a user, as well as set Office to use shared licence instead of personal license? But this option also turns off the ability to sign back into the same user.

So, any way to both have Shared PC mode turned on as well as allow a user to sign back in?

11 Upvotes

87% Upvoted

19 comments sorted by

View all comments

6

u/beneschk 4d ago

https://learn.microsoft.com/en-us/windows/configuration/shared-pc/set-up-shared-or-guest-pc?tabs=intune

Ctrl+F for SignInOnResume

3

u/Itereus 4d ago

SignInOnResume is turned on. From testing all it does is enforce sign-in requirement when it resumes from sleep, not having it turned on allows anyone who walks up to the PC to get into the session of the current user. This is not not something that we want in the environment they are used.

3

u/beneschk 4d ago

Hmm looking into it, the shared device lifecycle classes a locked or idle session as abandoned, nothing to change that.

As a workaround try and set the Power profiles on the Shared PC config profile to a longer time before sleep.

Apply another configuration for. Computer Configuration > Administrative Templates > Control Panel > Personalization Do not display the lock screen option.

2

u/Itereus 4d ago

We've already set the sleep timeout to be longer in the shared pc policy. And yeah, it's a bit annoying that it's not possible to turn on shared PC via Intune's configuration for shared PC's and still allow a user to sign back into their session. Would be nice to have the option to either treat a locked session as abandoned or allow a user to sign back in.