Skip to content

[ZT] Multi-user updates #21153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Mar 31, 2025
Merged

[ZT] Multi-user updates #21153

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a3cd862
fast user switching
ranbel Mar 25, 2025
488f1a3
DNS logging note
ranbel Mar 25, 2025
6838c09
edit wording
ranbel Mar 25, 2025
38d9ab9
edit description
ranbel Mar 31, 2025
d320239
remove WARP registration wording
ranbel Mar 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions ...onnections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ To request participation in this beta, contact your account team.

| System | Availability | Minimum WARP version |
| -------- | ------------ | -------------------- |
| Windows | ✅ | 2025.1.447.1 |
| Windows | ✅ | 2025.2.460.1 |
| macOS | ❌ | |
| Linux | ❌ | |
| iOS | ❌ | |
Expand All @@ -33,8 +33,8 @@ To request participation in this beta, contact your account team.

Cloudflare WARP supports multiple user registrations on a single Windows device. When deployed in multi-user mode, the WARP client will automatically switch user registrations after a user logs in to their Windows account. All traffic to Cloudflare will be attributed to the currently active Windows user. This allows administrators to apply identity-based policies and device settings, audit user activity, and remove individual users from a shared workstation.

:::note
A user must log out of their Windows account before switching to another account. A user cannot lock the screen and log in to another account, use the **Switch users** option in Windows, or have any other type of concurrent sessions.
:::caution[DNS logging]
If a user enables **Log DNS queries** in the WARP GUI (or runs `warp-cli dns log enable`), WARP will store all DNS queries on the device onto disk. Any user on the device will be able to examine the DNS queries of another user.
:::

## Enable multi-user mode
Expand Down Expand Up @@ -100,6 +100,7 @@ The following flowchart shows how WARP registration settings take effect as user
flowchart TB
start(["Enable multi-user mode"])-->reg["Active Windows user is prompted to register WARP"]
reg--"Log out of Windows"-->prelogin
reg--"Switch user"-->regexists

subgraph preloginbehavior["Windows login screen"]
prelogin{{"Is there a pre-login <br />registration?"}}
Expand All @@ -114,3 +115,13 @@ flowchart TB
regexists-. "No" .->reg
```

### Fast user switching

:::note
Requires [multi-user mode](#enable-multi-user-mode).
:::

[Fast user switching](https://learn.microsoft.com/windows/win32/shell/fast-user-switching) is a Windows feature that allows users to switch accounts without logging out. With fast user switching, multiple users may be logged in to the device and generating network traffic. The WARP client will attribute all traffic to the user who has the interactive desktop. For example, if user A is logged in and fast user switches to user B, traffic from both accounts will appear to come from user B. Now assume that user B logs out and there is no [pre-login registration](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/); WARP will continue to attribute traffic to user B since they still have the active registration.

To accurately attribute network traffic to specific users, Cloudflare recommends disabling fast user switching or at the very least configuring a [pre-login registration](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/).

Loading