Exclusions from Domain groups are ignored, but local groups work. (4321099)

Exclusions from Domain groups are ignored, but local groups work.

Exclusions for domain groups are not working, but local groups added to the exclusion list are enforced.  The error message received is: "Access Denied - No valid route found. Please contact your administrator."

This issue may occur with the use of the local 'Users' group when specified as a group for exclusion.

Desktop Login is trying to enumerate the group to check group membership, but is failing when it tries to read the built-in NT AUTHORITY\Interactive and NT AUTHORITY\Authenticated Users groups.

As a result, Desktop Login is setting a network error flag and because of this error it defaults to requiring Defender authentication.

1. Create a new local group on the workstation and add the required local or domain members to this group.

2. Open the Desktop Login configuration dialog and remove the local 'Users' group from the 'Exclusions' tab.

3. Add the newly created local group and apply the changes.

4. Test.