EnableFastFirstSignin seems to be a semi-announced feature that is only possible to configure using a Provisioning Package. I think the official documentation states that it is in preview.
But, let’s not care about that
What is it?
This:
Fast Sign-in for shared PC’s is being introduced in the latest Windows Insider build. No more “please wait while we setup your profile…” – (Policy CSP/Authentication/EnableFastFirstSignIn) #intune #modernworkplace #windows10 #windowsinsider pic.twitter.com/xbBrpHMjK0
— Michael Mardahl [MCSE] (@michael_mardahl) January 6, 2019
Is there any documentation for this seemingly awesome black magic?
Yes, at Docs@Microsoft
How do I set it up?
Prerequisites
Windows 10 – 1809
Windows ADK – 1809 – Windows Imaging and Design Configuration
Brief overview of what you need todo;
· Configure Provisioning Package
· Generate Provisioning Package
· Install Provisioning Package
Configure / Generate package
| Start Windows Imaging and Configuration Designer |
| Press to create Advanced Provisioning |
| Define the following settings: |
| Runtime Settings -> Policies -> Authentication ->
EnableFastFirstSignIn Select Enabled |
| Runtime Settings -> SharedPC -> EnabledSharedPCMode
Select TRUE |
| Runtime Settings -> SharedPC -> AccountManagement -> AccountModel
Select Domain-joined only |
| Select Export -> Provisioning Package |
| Enter information regarding name of package, version. Information is arbitrarily set.
Owner is: IT Admin Rank: 0 or 1 Press Next |
| Press Next |
| Select where to save the Provisioing Package
Press Next |
| Press Build |
| Press Finish |
Install Package
| Ensure you are using Windows 10 – 1809 |
| Open an elevated Powershell prompt, using a local administrative account |
| NOTE: PackagePath is unique to the package name and environment you are working
Execute the following command to install: Install-ProvisioningPackage -PackagePath “sample-name.ppkg” -QuietInstall |
After this the awesome experience should be on whatever endpoint you installed this on. As far as I can tell all that remains is Group Policy Object processing.
What happens in the background?
What does this magical black box of awesomeness actually do in the background? Microsoft has little to reveal, however quite a few people have posted findings on Twitter so far
Interesting stuff! According to https://t.co/tERbDEepP8, Fast First Signin pre-creates a “candidate profile” (thus the speedup), but may only work with Shared PC Mode, which might not be something to go into blindly: https://t.co/cLWzhXjhWL. Below are the policies set by the PPKG pic.twitter.com/rZGVGPXYIs
— Jacques Bensimon (@JacqBens) April 9, 2020
Trenteye seem to be digging into this further and this is what has been shared so far;
It overrides 6 packages and changes their “SetupPhase” — that is when AppX will process them. Undoubtedly, when you tested this these 6 packages might have been the only packages in this stage, but not anymore.
— Trentent Tye (@TrententTye) March 29, 2020
In my version of Windows 10 (2004 Insider) the override appears to miss a few packages… pic.twitter.com/WW91fMRtCp
— Trentent Tye (@TrententTye) March 29, 2020
And similar gains are made because EnableFastSignIn disables Windows Hello for Business… Which might be related to the AAD BrokerPlugin ? pic.twitter.com/DMB8zJ9tBa
— Trentent Tye (@TrententTye) March 29, 2020
— Trentent Tye (@TrententTye) March 29, 2020
Curiously, it sets policy settings to disable Bio as a credential option https://t.co/wkSYrQWp69
But not the AppX package. Which takes anywhere from 6-7 seconds for me when the policies are enabled, but 1.4 when disabled.
— Trentent Tye (@TrententTye) March 29, 2020