-
Notifications
You must be signed in to change notification settings - Fork 667
Update howto-sspr-windows.md #1550
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
We need to include the mentioned information, as it was confirmed by PG. This limitation is not currently documented in any official SSPR documentation.
Learn Build status updates of commit 2aea2f2: ✅ Validation status: passed
For more details, please refer to the build report. For any questions, please:
|
@ibarbato - Thank you for your contribution. Would you take a moment to sign the Contributor License Agreement (CLA)? After the CLA is signed, someone can review your pull request. Thanks! #label:"aq-pr-triaged" |
@ibarbato please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
**SSPR Compatibility with Windows 11:** Unlike previous versions such as Windows 10 22H2, Windows 11 does not support initiating the SSPR process from a locked user session. The SSPR must be initiated from the logon screen, ensuring that sessions currently locked out do not complicate or interfere with the reset process. | ||
**SSPR Process Overview:** To securely initiate the process, the system requires an appropriate session state. To achieve this, the system transitions out of the secure lock/unlock session by utilizing the session defined under "DefaultUser", which is internally generated by the SSPR service. This intermediary step is crucial as it enables the launch of the Web Dialog for SSPR, ensuring the process adheres to security protocols. | ||
**Technical Complexity and Misunderstandings:** The SSPR process involves multiple system components that must synchronize within specific time constraints, such as a 5-second window for RPC calls. There has been some confusion regarding the responsibilities of components, especially concerning Entra ID Authentication and LogonUI parts, which are sometimes perceived as separate from the SSPR process. | ||
**Performance and Error Handling:** If the transition to the secure session does not occur within the expected timeframe, the system defaults to the logon screen. This behavior, which may resemble a service repeatedly looping on the logon screen, can be mistakenly interpreted as an error. However, the system's response is deliberately designed to prevent unauthorized access attempts. This security-oriented functionality, while essential, might not align with typical user expectations. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
**Performance and Error Handling:** If the transition to the secure session does not occur within the expected timeframe, the system defaults to the logon screen. This behavior, which may resemble a service repeatedly looping on the logon screen, can be mistakenly interpreted as an error. However, the system's response is deliberately designed to prevent unauthorized access attempts. This security-oriented functionality, while essential, might not align with typical user expectations. | |
**Performance and Error Handling:** If the transition to the secure session does not occur within the expected timeframe, the system defaults to the logon screen. This behavior, which may resemble a service repeatedly looping on the logon screen, can be mistakenly interpreted as an error. However, the system's response is deliberately designed to prevent unauthorized access attempts. This security-oriented functionality, while essential, might not align with typical user expectations. | |
@@ -134,73 +139,74 @@ In this case, use one of the following workarounds: | |||
reg unload "hku\Default" | |||
``` | |||
|
|||
- The error "Something went wrong" can also occur when anything interrupts connectivity to the URL `https://passwordreset.microsoftonline.com/n/passwordreset`. For example, this error can occur when antivirus software runs on the workstation without exclusions for the URLs `passwordreset.microsoftonline.com`, `ajax.aspnetcdn.com`, and `ocsp.digicert.com`. Disable this software temporarily to test if the issue is resolved or not. | |||
- The error **"Something went wrong"** can also occur when anything interrupts connectivity to URL `https://passwordreset.microsoftonline.com/n/passwordreset`. For example, this error can occur when antivirus software runs on the workstation without exclusions for URLs `passwordreset.microsoftonline.com`, `ajax.aspnetcdn.com`, and `ocsp.digicert.com`. Disable this software temporarily to test if the issue is resolved or not. | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We need to include the mentioned information, as it was confirmed by PG. This limitation is not currently documented in any official SSPR documentation.