Password hint policies on a user provided device
Disclosed are various examples for remotely managing passwords using local security policies. A client device can be enrolled with a management service. The management service then transmits a password policy requiring a password hint to be defined by the user. A management component executed on the client device can then enforce the password policy by requiring a user to define a password hint in order to access enterprise resources.
1. A non-transitory computer-readable medium embodying a management component executed by a client device, wherein the management component is configured to cause the client device to at least:
enroll the client device, through the management component installed on the client device, with a management service;
in response to enrollment of the client device with the management service, determine that a local security policy stored by the management component on the client device indicates that a password hint is required to be defined by a user for a local password corresponding to the client device;
extract a Windows Relative Identifier (RID) from a Windows Security Identifier (SID) associated with a local user identity of the client device;
determine that a registry entry in a system registry of the client device fails to comprise the password hint, the registry entry being based upon the RID;
prompt a user to define the password hint associated with the local password corresponding to the client device; and
store the password hint in the registry entry on the client device.
2. The non-transitory computer-readable medium of claim 1 , wherein the management component is further configured to cause the client device to at least identify the registry entry on the client device associated with the password hint by determining a user identifier corresponding to the local user identity of the client device.
3. The non-transitory computer-readable medium of claim 1 , wherein the management component is further configured to cause the client device to obtain the SID using a Windows application programming interface (API) call to retrieve the SID associated with a currently logged-in user.
4. The non-transitory computer-readable medium of claim 1 , wherein the management component is executed as a system process to access the registry entry.
5. The non-transitory computer-readable medium of claim 1 , wherein the local security policy is obtained by the management component from the management service.
6. A method comprising:
enrolling, by a management component, a client device with a management service, wherein the management component is installed on the client device;
in response to enrolling the client device with the management service, determining, by the management component, that a local security policy stored by the management component on the client device indicates that a password hint is required to be defined by a user for a local password corresponding to the client device;
extracting, by the management component, a Windows Relative Identifier (RID) from a Windows Security Identifier (SID) associated with a local user identity of the client device;
determining, by the management component, that a registry entry in a system registry of the client device fails to comprise the password hint, the registry entry being based upon the RID;
prompting, by the management component, a user to define the password hint associated with the local password corresponding to the client device; and
storing, by the management component, the password hint in the registry entry.
7. The method of claim 6 , further comprising identifying, by the management component, the registry entry on the client device associated with the password hint by determining a user identifier corresponding to the local user identity of the client device.
8. The method of claim 6 , wherein the management component is further configured to cause the client device to obtain the SID using a Windows application programming interface (API) call to retrieve the SID associated with a currently logged-in user.
9. The method of claim 6 , wherein the management component is executed as a system process to access the registry entry.
10. The method of claim 6 , wherein the local security policy is obtained by the management component from the management service.
11. A system comprising:
a client device; and
a management component executable by the client device, wherein the management component causes the client device to at least:
enroll a client device, through a management component installed on the client device, with a management service;
in response to enrollment of the client device with the management service, determine that a local security policy stored by the management component on the client device indicates that a password hint is required to be defined by a user for a local password corresponding to the client device;
extract a Windows Relative Identifier (RID) from a Windows Security Identifier (SID) associated with a local user identity of the client device;
determine that a registry entry in a system registry of the client device fails to comprise the password hint, the registry entry being based upon the RID;
prompt a user to define the password hint associated with the local password corresponding to the client device; and
store the password hint in the registry entry.
12. The system of claim 11 , wherein the management component is further configured to cause the client device to at least identify the registry entry on the client device associated with the password hint by determining a user identifier corresponding to the local user identity of the client device.
13. The system of claim 11 , wherein the management component is further configured to cause the client device to obtain the SID using a Windows application programming interface (API) call to retrieve the SID associated with a currently logged-in user.
14. The system of claim 11 , wherein the local security policy is obtained by the management component from the management service.
15. The non-transitory computer-readable medium of claim 1 , wherein the management component is further configured to cause the client device to:
lock the client device in response to determining that the registry entry fails to comprise the password hint; and
unlock the client device in response to the user defining the password hint.
16. The non-transitory computer-readable medium of claim 1 , wherein the management component is further configured to cause the client device to store the password hint in the registry entry using a Windows application programming interface (API) to save the password hint to the registry entry.
17. The method of claim 6 , further comprising:
locking, by the management component, the client device in response to determining that the registry entry fails to comprise the password hint; and
unlocking, by the management component, the client device in response to the user defining the password hint.
18. The method of claim 6 , wherein the management component is further configured to cause the client device to store the password hint in the registry entry using a Windows application programming interface (API) to save the password hint to the registry entry.
19. The system of claim 11 , wherein the management component is further configured to cause the client device to:
lock the client device in response to determining that the registry entry fails to comprise the password hint; and
unlock the client device in response to the user defining the password hint.
20. The system of claim 11 , wherein the management component is further configured to cause the client device to store the password hint in the registry entry using a Windows application programming interface (API) to save the password hint to the registry entry.