Environment
Client for Open Enterprise Server 2 SP4 (IR6)
Situation
Establish the following policies:
- DontDisplayLastUserName = 1 ("Last Logged On User" = "Off" in Client Properties)
- DisableCAD = 0 ("Users are required to press CTRL-ALT-DEL to logon" enabled in Windows' "control.exe userpasswords2" or GPEDIT / Local Security Policy).
- Also, establish a "LegalNoticeCaption" and "LegalNoticeText" under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] (or in GPEDIT) so that the user will be prompted to agree to a usage policy prior to being presented with credential provider credentials.
With this configuration:
- If you reboot the computer and then press CTRL-ALT-DEL, agree to the legal policy, but then DON'T interact with the default credential that is shown, after 60 seconds the machine will time out and revert back to the "press CTRL-ALT-DEL to logon" state again.
- When you press CTRL-ALT-DEL for the second time, and agree to the legal notice for a second time, now the NCCredProvider credential that attempts to appear becomes "stuck". Showing just the credential provider bitmap but no actual logon fields or links, and the "busy" animation.
- If left alone long enough the machine may timeout and revert back to the "press CTRL-ALT-DEL to logon" state again, but attempting to logon again will still result in the "hung" credential. A restart of the machine is required in order to exit this state.
- If you interact with the initial credential shown after the reboot instead of allowing it to timeout, you will be able to login successfully. The issue only occurs after allowing the initial credential to timeout, and then attempting to display a credential for login again.
Resolution
Fixed in Client for Open Enterprise Server 2 SP4 (IR7).