Constant 2FA when using GCPW and the policy Display Last Sign-in

[JaredMT]

Background: We use GCPW to manage a fleet of Windows laptops (Alienware x14s).

Issue: We get constant 2FA checks on every sign-in. It's frustrating!

Strange Fix: We contacted Google Support, and they said, "This is an issue with the OS", and we should set the Group Policy "Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Don't display last signed-in." to "0" or Disabled.

Security: Unfortunately, this policy is required in the UK for certain types of work: not revealing user names on the device, such as the admin usernames, which would otherwise be kept confidential. The Windows documentation says, "If this policy is enabled, the full name of the last user to successfully sign in isn't displayed on the Secure Desktop" and in the recommended usage section, it says it should be used in secure environments (see their support website if the link doesn't work below) https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protec... This is a standard group policy to set. It often appears on lists of standard corporate policies. I've never worked at a company that didn't set this policy (or a progenitor). Google support seems to think this is "an OS issue". But it seems to me like it's a bug with GCPW.

Help: Why aren't more people complaining about this? There must be another workaround (he says with hope). Can you offer any help or a fix?

[SergioAlvarez]

Hi Jared, 

Have you identify if this only happens on the specific model, it could be that you cannot save the required information into the device and that is why you are being asked for the MFA. 

[AAlvarez]

I am using HP's Lenovo's and Dell laptops...all with windows 10 enterprise and get the same 2fa prompt everything signing it with GCPW.

[JaredMT]

Hey Sergio,

Yes, I have, and it makes no difference. Google Support has confirmed the Issue after reviewing my logs. In my original post, I describe the fix and how it reduces my security.

[AAlvarez]

have you any luck with windows 11? or same thing?

[AAlvarez]

We in NY are going to be enforcing 2fa come june and this is the first thing we have seen and heard complaints about. 

and how we cannot auto-populate the gcpw login with the domain @.......

[JaredMT]

It may be helpful for the community also to know that if you want to fix constant 2FA prompts when the laptop is LOCKED, you also need to disable the locked screen security for the username display by disabling this key (which means setting it to 1 instead of 3): 

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked