Sign-in Options¶
Beyond the password itself, Windows offers a dozen ways to sign in or to skip signing in: PINs, picture passwords, security questions, Microsoft accounts, automatic logon, and a password field with a reveal button. Each is a convenience that weakens the login. This page turns off the ones a work machine shouldn't have.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates unless marked otherwise. A few are in secpol.msc → Security Options.
Microsoft accounts¶
A consumer Microsoft account on a work machine means the login is controlled by a service outside the organization, and files and settings sync to it.
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.10.41.1 | Block all consumer Microsoft account user authentication | Windows Components → Microsoft accounts | Enabled | No consumer Microsoft account can sign in or be added |
| 18.10.6.1 | Allow Microsoft accounts to be optional | Windows Components → App runtime | Enabled | Store apps that normally demand a Microsoft account work without one |
Alternative sign-in methods¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.9.29.4 | Turn on convenience PIN sign-in | System → Logon | Disabled | A 4-digit PIN is a weaker credential than the password |
| 18.10.15.3 | Prevent the use of security questions for local accounts | Windows Components → Credential User Interface | Enabled | Security questions ("first pet's name") are guessable and reset the password without knowing it |
| 18.10.15.1 | Do not display the password reveal button | Windows Components → Credential User Interface | Enabled | The eye icon shows the typed password to anyone watching |
| 18.10.80.1 | Enable ESS with Supported Peripherals | Windows Components → Windows Hello for Business | Enabled: 1 | Enhanced Sign-in Security isolates biometric data in a secure component |
| 18.10.9.1.1 | Configure enhanced anti-spoofing | Windows Components → Biometrics → Facial Features | Enabled | Face sign-in rejects photos and masks |
| 18.10.5.1 | Let Windows apps activate with voice while the system is locked | Windows Components → App Privacy | Enabled: Force Deny | No voice assistant on the lock screen |
| STIG WN11-CC-000255 | Use a hardware security device | Windows Components → Windows Hello for Business | Enabled | Windows Hello keys are stored in the TPM, not on disk |
| STIG WN11-CC-000260 | Minimum PIN length | Windows Components → Windows Hello for Business → PIN Complexity | Enabled: 6 | A Windows Hello PIN of at least six characters |
Automatic logon and lock screen leaks¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.5.1 | MSS: (AutoAdminLogon) Enable Automatic Logon | MSS (Legacy) | Disabled | Auto-logon stores the password in the registry in plain text and skips the login screen. Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = 0, and delete DefaultPassword if present. |
| 18.10.83.2 | Sign-in and lock last interactive user automatically after a restart | Windows Components → Windows Logon Options | Disabled | After an update restart, Windows would sign the last user back in |
| 18.10.83.1 | Configure the transmission of the user's password in the content of MPR notifications sent by winlogon | Windows Components → Windows Logon Options | Disabled | Network providers don't get the plaintext password at logon |
| 18.9.29.1 | Block user from showing account details on sign-in | System → Logon | Enabled | Email address and full name don't appear on the login screen |
| 18.9.29.2 | Do not display network selection UI | System → Logon | Enabled | No one can change Wi-Fi networks from the lock screen |
| STIG WN11-CC-000130 | Enumerate local users on domain-joined computers | System → Logon | Disabled | The login screen doesn't list the local accounts on a domain machine |
| STIG WN11-CC-000039 | Run as different user (remove from context menus) | Registry, below | Removed | The right-click "Run as different user" option prompts for credentials; hiding it stops users being tricked into typing an admin password into a fake prompt |
| 18.9.29.3 | Turn off app notifications on the lock screen | System → Logon | Enabled | Message previews don't show while locked |
| 19.5.1.1 | Turn off toast notifications on the lock screen | User Configuration → Start Menu and Taskbar → Notifications | Enabled | Same, per user |
| 18.1.1.1 | Prevent enabling lock screen camera | Control Panel → Personalization | Enabled | Camera can't be used from the lock screen |
| 18.1.1.2 | Prevent enabling lock screen slide show | Control Panel → Personalization | Enabled | Slide shows can display files from user folders while locked |
| 2.3.7.6 | Interactive logon: Prompt user to change password before expiration (secpol.msc) |
Security Options | 14 days | Users get warning instead of a surprise lockout |
| 2.3.7.7 | Interactive logon: Smart card removal behavior (secpol.msc) |
Security Options | Lock Workstation | Pulling the card locks the session |
Apply the common ones from the command line¶
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 0 /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v AllowDomainPINLogon /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v NoLocalPasswordResetQuestions /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CredUI" /v DisablePasswordReveal /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v BlockUserFromShowingAccountDetailsOnSignin /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DontDisplayNetworkSelectionUI /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableLockScreenAppNotifications /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAutomaticRestartSignOn /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v NoConnectedUser /t REG_DWORD /d 3 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnumerateLocalUsers /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked" /v "{2A6B5A5C-2A42-4A9C-8C4F-E7A94B1A6F2B}" /t REG_SZ /d "" /f
The last line hides "Run as different user" for .exe files; the STIG lists four GUIDs to block (for .exe, .bat, .cmd, and .msc); see WN11-CC-000039 for the full set.
Verify¶
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
AutoAdminLogon 0, and the second query says the value can't be found.
Example¶
reg query ...\Winlogon shows AutoAdminLogon 1 and DefaultPassword Summer2024!. Anyone who boots the machine is logged in as that user, and the password is readable by any account. Set AutoAdminLogon to 0, delete DefaultPassword, and change the user's password since it's been exposed.