Sophos SafeGuard with AutoLogon

Question

We are using Win10 machines in a Domain. Trying to create kiosk mode where the machines auto-logo to a Domain account. 
 Installed is Safeguard Enterprise 8.30.0.76 
 I have created the Domain account on the machine such that the Windows 10 logon screen shows 4 accounts; Kiosk-user , Other user, Domain\Kiosk-user (with Sophos icon) & Other user (with Sophos icon). 
 But there is no way for me to use Auto-Logon from sysinternals or "control userpasswords2" to login to the Domain\Kiosk-user (with Sophos icon). 
 Please advise.

MichaelMcLannahan · Accepted Answer

Morning! 
 
 Back in the day we used to have GINA to process your login. This could be easily bypassed/hacked so MS introduced Credential Providers. An "application" that allowed a user to sign in and authenticate and then if needed pass this auth onto other apps in a transparent manner. The Windows Credential Provider is that head/shoulders icon. However, some people use a SmartCard to login with, others can use a Fingerprint or Windows Hello - All Credential Providers. Sophos has its own Credential Provider - the "cog". Logging in with this then makes the session transparent to the user - they don't need to authenticate with SafeGuard again - that's now been done. 
 However - if you DON'T use the Sophos CP- SafeGuard doesn't know who you are. You can appreciate that when you can encrypt and decrypt files by policy (and therefore user policy) this is an issue. If SafeGuard doesn't know who you are - how can it allow you to encrypt or decrypt any content securely? 
 You can hide the other providers so users only see the Sophos cog to log in with - this is neater but this led to issues when I tried it. Random auth popups during the users session, and things did just not work correctly. It was easier/safer to just tell my users "always log in with the Sophos cog!" 
 
 SafeGuard Enterprise: How to hide Credential Providers from the Windows Logon User Interface using Windows Group Policy (sophos.com) 
 
 As I said - I wouldn't go down this route - but it's an option. 
 
 I can't find the article where they DID list their compatible providers (a few smartcards on a Lenovo as I recall?) when you could use another Credential Provider and it would work/pass through to SafeGuard. SafeGuard has now declared an EOL, so I'm not confident they'll add any functionality at this stage now sadly. 
 
 I hope that helps a little?