Behaviour policies are the toggles that decide exactly what the credential provider and the agent do at the logon and lock screens: whether auto-logon runs at all, whether the session locks straight back down once it does, and whether a legal notice or the Ctrl-Alt-Del prompt is allowed to stand in the way. Every one of them is set as a group default and can be overridden per agent.
How it works
A group carries a default value for each policy. An individual agent’s Config page can leave any of them on inherit — the group’s value applies — or set an explicit on or off that takes precedence over the group regardless of what the group says. Editing a group’s policy re-applies to every member that has not overridden it: saving bumps the configuration version of every member agent, so they pick up the new default on their next poll. An override is not touched by that save — it keeps whatever an admin set until it is explicitly changed back to inherit.
The eight toggles
Auto-logon
Signs the stored credential in automatically at the logon screen when nobody is signed in. Gated by both the machine’s licence seat and any kiosk schedule in effect.
Auto-unlock
When the console locks, brings it back without a password by disconnecting and reconnecting the session. Console only — never an RDP session — and only when a user is actually logged in, covered in full on hands-free Windows logon.
Auto-relogon
After the signed-in user logs off or is disconnected, signs the stored credential straight back in.
Lock after logon
Locks the session immediately once auto-logon completes, so the machine is signed in but sitting at the lock screen rather than an open desktop — useful where auto-unlock, not auto-logon, is meant to be doing the actual work of presenting a desktop.
Handle legal notice
Clears the pre-logon legal notice banner so it cannot block auto-logon, and restores the machine’s original banner text the moment the toggle is switched off rather than leaving it blank.
Handle Ctrl-Alt-Del
Sets the “do not require Ctrl-Alt-Del” policy so the secure-attention prompt cannot stop a hands-free logon, restoring the original setting when switched off.
Close programs before logoff
Before an agent-initiated logoff — a rotation, most commonly — asks the interactive user’s programs to close gracefully first, so an unsaved-changes dialog cannot stall the logoff indefinitely; a process that does not respond in time is closed forcibly. On by default, because nobody is at an unattended kiosk to dismiss that dialog for it.
Suppress native auto-logon
Switches off Windows’ own AutoAdminLogon once a machine has a managed credential deployed to it, so
the two mechanisms cannot disagree about who signs a user in. On by default; the mechanism itself,
including what it does and does not remove from the registry, is covered on
hands-free Windows logon.
Limits
Handle legal notice and Handle Ctrl-Alt-Del act at the Winlogon layer, before the credential provider loads — they are agent-side registry policy, not something the provider can be asked to dismiss on its own. They re-assert on every check, so a Group Policy refresh that reintroduces the original banner or prompt is corrected again on the agent’s next pass rather than requiring a manual fix.
An override is all-or-nothing per policy, not partial. Setting an explicit on or off for one toggle on one agent does not let that same agent inherit a different toggle selectively from two different groups — the whole set of overrides lives on that one agent’s Config page, against the one group it belongs to.
These toggles do not include rotation, the kiosk schedule or diagnostics logging, even though an agent’s effective policy page shows them alongside the eight above. Each has its own schedule or threshold rather than a simple on/off, and each is covered on its own page — see credential storage and rotation, kiosk scheduling and remote diagnostics.