With the Add Local Domain User (ALDU) function, domain users who have previously and are currently logged on to the client system can authenticate through the Pre-Boot, even if the administrator has not explicitly assigned the user to the client system.
While this captures the regular users of the system, in some cases, an administrator who has previously configured the system is also granted access. This might be applicable to some, but not all, users.
To address this situation, you can add a blacklist of users to the Add Local Domain User Settings policy. Users added to the blacklist are excluded from the list of users assigned by the ALDU function.
Note
Prioritization of policy assignment rules is not applicable to the ALDU blacklist policy.