How to setup/configure "Disable the local storage of passwords and credentials" using Intune?

Question

How to setup/configure "Disable the local storage of passwords and credentials" using Intune?

We have below recommendations in our tenant inside M365 Defender.

See below screenshot.

Answer 1

Hey, this also got me! I have created my FIRST blog post! I hope this is helpfull.

https://open.substack.com/pub/mbcloudteck/p/hklmsystemcurrentcontrolsetcontrollsadisabledoma?r=2jeuoc&utm_campaign=post&utm_medium=web

Trying to make it to 100% within Microsoft Secure Score? Here is a common remediation item “Disable the local storage of passwords and credentials” under the “Accounts” category that Microsoft dose not give you an OOTB cloud only solution / recommendation to.

I will be attempting to create an Import Export JSON of a perfect set of Secure score settings for Win 10/11. So stay tuned. Here is piece 1/100!

Kind regards

Answer 2

Here’s how you can disable the local storage of passwords and credentials with Intune:

1. Open the Microsoft Endpoint Manager admin center.
2. Select Devices > Configuration profiles > Create profile.
3. Enter a name and description for the profile.
4. Select Windows 10 and later as the platform.
5. Select Custom as the profile type.
6. Select Add > Oma-Uri settings.
7. Enter the following information:

• Name: Enter a name for the setting.
• Description: Enter a description for the setting.
• Oma-Uri: ./Device/Vendor/MSFT/Policy/Config/Security/LocalAccounts/DisablePasswordStorage
• Data type: Select Integer
• Value: Enter 1

1. Save the profile.

Answer 3

Through Network access: Do not allow storage of passwords and credentials for network authentication- you can set up.

This is important cause, If you aren't connected to the network, then you will not have cached creds to log in with.

Follow this article for Network access settings:

• https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication