Disabling "Generate New Windows logon Credentials" about iap-desktop

[jpassing]

we need to disable "Generate New Windows logon Credentials"

Generating Windows credentials requires the compute.instances.setMetadata permission on the VM instance or the enclosing project. This permission is part of the Compute Instance Admin and a few other roles. If the VM has an attached service account, generating credentials additionally requires the iam.serviceAccounts.actAs permission on the service account or enclosing project. This permission is part of the Service Account User role.

If want to make sure that users can't generate Windows credentials, make sure that you don't grant them these permissions/roles.

When you connect to a Windows VM using IAP Desktop and haven't configured any credentials yet, you typically see this dialog:

Before showing that dialog, IAP Desktop actually checks whether you have the the compute.instances.setMetadata permission -- and if you don't, it won't even show the Generate new credentials option. I guess this is the behavior you're looking for?

is there a way to make the SQL admin authentication as the default and disable the Windows authentication

You can disable SQL Server Windows authentication in the connection settings -- either for individual VMs, zones, or entire projects:

But this setting only applies to you, there's currently no way to disable the option for all users of a project.

[aymanelbacha]

hi @jpassing,
Thanks for sharing the above.
Indeed that's what I was looking for, mistakenly putting the compute Instance Admin ROLE, now after changing it to Compute Viewer it has the limited privileges.

[jpassing]

Thanks for confirming, I'll close the issue then.