Fast User Switching with Windows Authclient

Fast User Switching with the RapidIdentity Windows Authentication Client

Windows Authentication Client provides a Fast User Switching (FUS) feature, enabling users to utilize the HideFastUserSwitching Windows setting for enhanced Windows authentication efficiency. This document outlines various methods to configure FUS, enabling users to take full advantage of this functionality.

Description: Fast user switching allows multiple users to share a single computer without logging out of their individual accounts. It enables users to switch between user accounts quickly without closing all applications or logging off the current user. This feature is referred to as fast user switching.

The available configuration methods are based on the different release versions of WAC:

1. Fast User Switching (FUS) UI/UX Enhancements
2. Fast User Switching (FUS) Traditional Approach

Fast User Switching (FUS) UI/UX Enhancements

The simplest way to perform FUS configurations is with the help of the Windows Authentication Client UI. This Feature is available for WAC version v1.6.0 and above.

There are two ways for an Admin to configure FUS for the machine.

1. Admin can configure FUS at the time of WAC installation: When the administrator installs the WAC on a user's machine, either through the installation wizard or silently via the command line they have the option to enable or disable the FUS feature for that particular machine.

Follow these steps to perform the FUS configuration at the time of installation (Wizard):

• Double click on the Installer to open the Setup Wizard. When the screen below is visible, click on 'Next'.

• Admin will see a screen where they can view the FUS configuration. Depending on the desired user experience, an Admin can select Enable or Disable via a radio button to configure the setting.
• Once the correct option is selected, click Next.

• Select the Destination Folder and click Next.

• If Admin is ready to install then click the Install button to finish the installation. Once installed, you will be asked to restart the device.

Use this command to perform the FUS configuration at the time of installation (Silent):

msiexec.exe /i "Path for the installer" /quiet /passive APIKEY="api key string" SERVER_URL="tenant url"  DOMAIN="domain name" ENABLE_FAST_USER_SWITCHING="0 or 1"

Example: msiexec.exe /i "C:\AuthC_install\RapidIdentity Client for Windows.msi" /quiet /passive APIKEY="$s5TOu3vlTlabyHe9Q17AgQ==.1KRQp0gAoOdIvGdZqS02Te2HzxzIpU85/uv0TD5uVWQ=$" SERVER_URL="https://iac53adaf6cd3d440c8f5765dc08fc8f6c.dev-rapididentity.com"  DOMAIN="." ENABLE_FAST_USER_SWITCHING="1"

2. Admin can configure FUS after installation: Once the FUS is configured during installation, or if the administrator forgets to configure it at that time, there is an option available in the WAC UI to configure FUS for a specific machine post-installation.

Follow the steps to perform the FUS configuration Post-Installation:

• Start the WAC user authentication process. On the Username screen you can see the Settings link at the top of the page.

• Once a user clicks on this link, they will see an Admin Account validation page. This page is used to validate user roles and authenticity. The user will need to provide their username and password to get the access of Next Configuration page. Only users that have System Admin or Tenant Admin permissions can access the Settings screen.

• Once the user can see the configuration page user can modify FUS configuration for the machine.

• Once an Administrator is validated, they will see the Update Settings screen. Here they can select Enable/Disable as desired to update the FUS configuration for this specific device.

Fast User Switching (FUS) Traditional Approach

This section includes a brief description of the Fast User Switching (FUS) feature, pre-requisites to use it in Windows AuthClient, and the process of how it will work. It also details the affected GPO policies with FUS. The traditional approach will be available for WAC version 1.3.0 and above.

GPO Policies/Registry Settings to update:

Fast User Switching: If enabled, this registry setting will cause the Switch User interface to be hidden from the user attempting to log on or the lock screen for a logged-in user.

User can enable this setting through one of the following options:
a. GPO: In "gpedit.msc" go to "Local Group Policy>Computer Configuration>Administrative Templates>System>Logon" and set "Hide entry points for Fast User Switching" to Enabled. Enabling this policy will disable Fast User Switching.
b. Registry Editor: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "HideFastUserSwitching"=dword:00000001

Don't display last signed-in: If you enable this setting, the last logged-in user name is hidden from the lock screen.
User can enable this setting through one of the following options:
a. GPO: group policy “Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive Logon > Interactive logon: Don't display last signed-in -> Enabled”
b. Registry Editor: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=dword:00000001

FUS process in Windows Authclient:

• When FUS is Enabled: If an admin enables this setting, when users lock their machines the switching user option from logged-in window is disabled. Any other user attempting to log in through the Windows AuthClient login process will be given an error message by Windows, which means only the locked user can unlock the machine and the session remains active.
  Step 1: Admin/User Enable FUS.

Step 2: Sign out from the machine.
Step 3: User logs in using RI Client with any Authentication method (Example shown here with Password)

Step 4: Once user logged in using WAC user will be redirected to RI Profile. User can work and locks the machine .
Step 5: User will not see the switch user option on the logged-in window.

Step 6: Other WAC user tries to login using any authentication method.

When other user tries to log in, Windows will display error message.

• When FUS is Disable: When FUS is disabled and any user lock the machine and other user try to login using WAC, they can logged in to the machine also get switch user option on logged-in window.

Step 1: Disable FUS

Step 2: Login with a WAC user and lock the session.
Step 3: Login with any other WAC user using any authentication method (Password, Duo, SMS etc.)

Step 4: User successfully logs in.
Step 5: User locks the machine. Now any user can switch easily to his machine by clicking on Switch user.

• When dontdisplaylastusername is enabled: This setting only affects the Windows Logged-in screen when FUS is enabled.

  • FUS and dontdisplaylastusername is enabled: When both of these settings are enable user can not see the last logged-in user name on logged-in window.

* FUS is enabled and dontdisplaylastusername is disabled: When FUS is enable and dontdisplaylastusername is disable then user can see the last logged-in user name(Domainname\username) on logged-in window.

Fast User Switching Demo Video