Fast User Switching (FUS) Traditional Approach

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

This section includes a brief description of the Fast User Switching (FUS) feature, pre-requisites to use it in Windows AuthClient, and the process of how it will work. It also details the affected GPO policies with FUS. The traditional approach will be available for WAC version 1.3.0 and above.

Note:Prerequisite: User/Admin have access to edit the Registry Editor/GPO settings for his Windows machine.

GPO Policies/Registry Settings to update:

Fast User Switching: If enabled, this registry setting will cause the Switch User interface to be hidden from the user attempting to log on or the lock screen for a logged-in user.

  1. Enable Fast User Switching setting using one of these methods:
    1. Using GPO: In "gpedit.msc" go to "Local Group Policy>Computer Configuration>Administrative Templates>System>Logon" and set "Hide entry points for Fast User Switching" to Enabled
      Enabling this policy will disable Fast User Switching.
    2. Using Registry Editor: Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" and set "HideFastUserSwitching"=dword:00000001
  2. Configure "Don't display last signed-in" setting using one of these methods:
    If you enable this setting, the last logged-in user name is hidden from the lock screen.
    1. Using GPO: Navigate to "Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive Logon > Interactive logon: Don't display last signed-in -> Enabled"
    2. Using Registry Editor: Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" and set "dontdisplaylastusername"=dword:00000001
  3. Enable FUS in Windows Authclient:
    When FUS is Enabled: If an admin enables this setting, when users lock their machines the switching user option from logged-in window is disabled. Any other user attempting to log in through the Windows AuthClient login process will be given an error message by Windows, which means only the locked user can unlock the machine and the session remains active.
    1. Admin/User Enable FUS
    2. Sign out from the machine
    3. User logs in using RI Client with any Authentication method (Example shown here with Password)
    4. Once user logged in using WAC user will be redirected to RI Profile. User can work and locks the machine
    5. User will not see the switch user option on the logged-in window
    6. Other WAC user tries to login using any authentication method
      When other user tries to log in, Windows will display error message.
  4. Disable FUS in Windows Authclient:
    When FUS is Disable: When FUS is disabled and any user lock the machine and other user try to login using WAC, they can logged in to the machine also get switch user option on logged-in window.
    1. Disable FUS
    2. Login with a WAC user and lock the session
    3. Login with any other WAC user using any authentication method (Password, Duo, SMS etc.)
    4. User successfully logs in
    5. User locks the machine. Now any user can switch easily to his machine by clicking on Switch user
Note:All users who locked their machine and switch back to their session the session will maintained by windows.

When dontdisplaylastusername is enabled: This setting only affects the Windows Logged-in screen when FUS is enabled.

FUS and dontdisplaylastusername is enabled: When both of these settings are enable user can not see the last logged-in user name on logged-in window.

* **FUS is enabled** and **dontdisplaylastusername is disabled:** When FUS is enable and dontdisplaylastusername is disable then user can see the last logged-in user name(Domainname\username) on logged-in window.

Note:Do not uninstall or Update your Windows authclient Installer if any user lock the machine. This will cause issues in next installation and uninstallation.

Demo Video for Fast User Switching