slopfront
Reddit, read-only. No JavaScript. No cookies. No tracking.
preferences

Endpoint Privilege Management - Windows Authentication

7 points · submitted Dec 2023 by u/Svdbusse · General Question

We’re working through our first deployment of EPM and have noticed a strange behaviour when Windows Auth is configured.

If a second user has logged into the device, if the original/first user is prompted for Windows Auth when triggering EPM, the UAC prompt defaults to the second users password or pin, Not the user that triggered the EPM request. You can manually select the first user and authenticate. But the user experience isn’t great.

Has anyone else seen this?

8 comments · 90% upvoted · other discussions

comments

Rudyooms 2 points · Dec 2023 · PatchMyPC

Mmm... that could be a good reason why AVD is not supported with EPM.. :).. But yeah i would say its a bit weird behavior...

Svdbusse [OP] 1 points · Dec 2023

In this case we weren’t using it in AVD. But yes, perhaps it’s known not to play nice with multiple users. Replicated the experience across a couple of tenants too as we thought Microsoft baselines or one of our other device configs could be causing the issue. But no, same experience across both.

Rudyooms 1 points · Dec 2023 · PatchMyPC

single session vs multi session. As mentioned here, epm will support avd “single “ session…and i assume not multi session because of the behavior you mentioned (or maybe some other reasons as well :)) But you got me interested :)….

https://techcommunity.microsoft.com/t5/microsoft-intune-blog/microsoft-intune-endpoint-privilege-management-for-windows-365/ba-p/3955940

jasonsandys 1 points · Dec 2023 · Verified Microsoft Employee

u/Svdbusse, can you define exactly what you mean by having multiple users here? Are they simultaneous logons using user switching or has the first user logged out before the second user logged in?

Svdbusse [OP] 2 points · Dec 2023

The latter, the first user has logged out. A second user logged in, and then logged out. The first user logs back in and then when elevating with EPM UAC defaults the username selection to the second user.

ALoneVulpes 1 points · Aug 2026

Just wondering if anyone found a fix for this?

Our orgs devices are autopilot enrolled. We've deployed EPM to users but it defaults to the Enrolled By User and not the Primary user. While they can still use EPM, they have to manually choose other user which is not great.

Removing stored credentials didn't fix the issue.

swissbuechi 1 points · Dec 2023

How is the device enrolled? When you want to use a shared device, you need to enroll via autopilot self-deploying mode. Alternatively, you can also manually remove the primary user of the device to achieve the same shared-device behavior.

I have limited hands-on experiance with EPM. Just tought it could be related.

Svdbusse [OP] 1 points · Dec 2023

Autopilot user driven Entra ID joined. The devices aren’t intentionally shared. The first user is the listed primary user. It just happened that a second user logged into the device, and when the primary user logs back in an elevates, it defaults and prompts for the credentials of the second user. Deleting the user profile of the second user also doesn’t resolve it. Which makes me think the last user who had the intune EPM profile applied is tattooing itself somewhere.