Hello Daniel,

I think you can try the Policy Login Options and set the Default Domains.

If the user is found in one of these repos, then the user will be logged in.  If the same user exists in multiple repositories, AA will prompt for more information (asking for the repo name). Also note that the search will happen for all listed repositories. So, if the user is found in the first repo, it will still search the rest of the repos listed.

Let me know if that is what you are looking for.

Thanks.

Regards,

Luciano Testa

Thanks for your answer!
this definetly sounds like a step in the right direction..
Where do i set that?

Is this a client side setting in "config.properties" or is that a setting server side?
(i got no rights server side and would have to relay that to our admins then..)

Hello Daniel,

Yes, that would be on the server side under Policies.

There is no client setting as far as I know. If you add the workstation to the domain then the Windows Client should read this information and show it, but there is nothing to configure there.

Thanks.

Regards,

Luciano Testa

I talked to my colleagues and it seems like we talked past each other...

The Realms are already set in the policies.

But the client automatically resets the "username-field" to ".\USERNAME" at which point the client doesn't initiate a search but just tries to do a local login.

Hello Daniel,

Is the workstation added to the domain?

Thanks.

Regards,

Luciano Testa

It is showing up on the AAF admin page in the workstations...
(And if we specify the realm during login it works correctly as well)

If you are talking about some additional AD domain or something then no because we don't use AF.

But when logging into windows for the first time with AAF it doesn't fill that automatically and you would have to tell all users to fill that in manually...

I see. Let me check this internally.

Thanks.

Regards,

Luciano Testa

Hello Daniel,

It looks like it is showing the last user to log in. Can you confirm this please?

If that is the case, then you can change this behavior with this policy:

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name

Give it a try and let me know the results.

Thanks.

Regards,

Luciano Testa

We don't want to disable that to be honest...
(would slow down users logging in)

We have set the workgroup of our AAF-Clients to our Realm-Name so it auto sets the realm when a user ONLY enters the username..
But since AAF automatically sets it to ".\" that barely helps us.

Hello Daniel,

I would really like to know what happens after changing the policy I mentioned before.

It would give me very useful information.

Thanks.

Regards,

Luciano Testa