Logging in with Credential Provider on Non-Domain Windows 10/11 Laptops with Non-Existing Local Accounts

[nelsonduvall]

Is it possible to use the Credential Provider on a Windows 10 or 11 laptop, which is not part of an Active Directory domain, to log in with a user account that hasn't been created in the local accounts list yet?
I've tried this in different Windows Laptops, both with passwd resolvers and ldap (Openldap) resolvers, but so far was not able to have it working. I keep getting the "Wrong username or password error!" after the login process is done in PrivacyIDEA, even though the credentials and the HTOP are correct and working.

[nilsbehlen]

The user has to exist in windows AND in privacyidea, so i guess the user that you tried with did not exist in windows?

[nelsonduvall]

Correct, the user does not exist in the Windows computer. The idea would be to have the accounts created locally in Windows after a successful authentication via PrivacyIDEA, in the same way it's done when doing logins with AD users - if the user has never done a login on a particular computer it will be added automatically.
Having to pre-create all the possible accounts in all the Windows computers is not desirable, specially having in consideration that only a few of those accounts will actually ever be used in a particular Windows computer. Is there any chance this can be overcome somehow?

[nilsbehlen]

Not with the Credential Provider, as that is way out of the scope of it's job. You will have to do some scripting yourself, i don't really know a way from the top of my hat.