Default Domain for Login and Lock Screens

By default, the eLux login and lock screens preselect the first domain in the domain picker, even when more domains are available.

Users then have to manually switch domains on every login.

An administrator can configure a default domain that is automatically preselected instead, for AD (password), AD with smartcard, and Imprivata login and lock screens:

• Preselection — The configured domain is preselected on the login screen, unlock screen, and Imprivata picker, instead of the first domain in the list.
• User override — Users can still pick a different domain for their login attempt; the choice isn’t overwritten while they’re interacting with the screen.
• Fallback — If the configured domain is empty, invalid, or no longer available, AD flows fall back to the configured default Kerberos realm, or otherwise a valid domain from the list — login is never blocked.

No additional client-side configuration is required beyond the setting below.

Configuration

Set the default domain in /setup/terminal.ini, section Security, key DefaultDomain, pushed via Scout Advanced File Entries:

Enter the domain as it appears in the domain list — either the Kerberos realm (e.g. DEV.unicon-ka.de) or the display name (e.g. DEV).

Matching is case-insensitive, and the value is canonicalized against the live domain list automatically.

The selected domain is resolved to the correct Kerberos realm before authenticating. For smartcard login, the realm is inferred from the certificate first and only falls back to the selected domain if needed.

The change takes effect the next time the login or lock screen appears.

Good to Know

• On the main unlock screen, AD users re-authenticate as the locked-in user — there’s no domain picker.
• If the configured value doesn’t match any domain in the list, the device log records DefaultDomain '<value>' does not match any available domain.