Policy CSP - WindowsLogon


WindowsLogon policies

WindowsLogon/AllowAutomaticRestartSignOn
WindowsLogon/ConfigAutomaticRestartSignOn
WindowsLogon/DisableLockScreenAppNotifications
WindowsLogon/DontDisplayNetworkSelectionUI
WindowsLogon/EnableFirstLogonAnimation
WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
WindowsLogon/HideFastUserSwitching

WindowsLogon/AllowAutomaticRestartSignOn

Home Pro Business Enterprise Education Mobile Mobile Enterprise
check mark6 check mark6 check mark6 check mark6 check mark6

Scope:

  • Device

This policy setting controls whether a device automatically signs in and locks the last interactive user after the system restarts or after a shutdown and cold boot.

This occurs only if the last interactive user did not sign out before the restart or shutdown.​

If the device is joined to Active Directory or Azure Active Directory, this policy applies only to Windows Update restarts. Otherwise, this policy applies to both Windows Update restarts and user-initiated restarts and shutdowns.​

If you do not configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​

After enabling this policy, you can configure its settings through the ConfigAutomaticRestartSignOn policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​.

If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts.

Tip

This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.

You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

ADMX Info:

  • GP English name: Sign-in and lock last interactive user automatically after a restart
  • GP name: AutomaticRestartSignOn
  • GP path: Windows Components/Windows Logon Options
  • GP ADMX file name: WinLogon.admx

WindowsLogon/ConfigAutomaticRestartSignOn

Home Pro Business Enterprise Education Mobile Mobile Enterprise
check mark6 check mark6 check mark6 check mark6 check mark6

Scope:

  • Device

This policy setting controls the configuration under which an automatic restart, sign on, and lock occurs after a restart or cold boot. If you chose “Disabled” in the AllowAutomaticRestartSignOn policy, then automatic sign on does not occur and this policy need not be configured.

If you enable this policy setting, you can choose one of the following two options:

  • Enabled if BitLocker is on and not suspended: Specifies that automatic sign on and lock occurs only if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components.
    BitLocker is suspended during updates if:
    • The device does not have TPM 2.0 and PCR7
    • The device does not use a TPM-only protector
  • Always Enabled: Specifies that automatic sign on happens even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location.

If you disable or do not configure this setting, automatic sign on defaults to the “Enabled if BitLocker is on and not suspended” behavior.

Tip

This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.

You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

ADMX Info:

  • GP English name: Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot
  • GP name: ConfigAutomaticRestartSignOn
  • GP path: Windows Components/Windows Logon Options
  • GP ADMX file name: WinLogon.admx

WindowsLogon/DisableLockScreenAppNotifications

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark check mark check mark check mark cross mark cross mark

Scope:

  • Device

This policy setting allows you to prevent app notifications from appearing on the lock screen.

If you enable this policy setting, no app notifications are displayed on the lock screen.

If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen.

Tip

This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.

You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

ADMX Info:

  • GP English name: Turn off app notifications on the lock screen
  • GP name: DisableLockScreenAppNotifications
  • GP path: System/Logon
  • GP ADMX file name: logon.admx

WindowsLogon/DontDisplayNetworkSelectionUI

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark check mark check mark check mark cross mark cross mark

Scope:

  • Device

This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen.

If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows.

If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows.

Here is an example to enable this policy:

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Atomic>
      <CmdID>300</CmdID>
      <Replace>
        <CmdID>301</CmdID>
        <Item>
          <Target>
            <LocURI>./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI</LocURI>
          </Target>
          <Meta>
            <Format xmlns="syncml:metinf">chr</Format>
          </Meta>
          <Data><![CDATA[<enabled/>]]></Data>
        </Item>
      </Replace>
    </Atomic>
    <Final/>
  </SyncBody>
</SyncML>

Tip

This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.

You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

ADMX Info:

  • GP English name: Do not display network selection UI
  • GP name: DontDisplayNetworkSelectionUI
  • GP path: System/Logon
  • GP ADMX file name: logon.admx

WindowsLogon/EnableFirstLogonAnimation

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark6 check mark6 check mark6 check mark6

Scope:

  • Device

This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users are offered the opt-in prompt for services during their first sign-in.

If you enable this policy setting, Microsoft account users see the opt-in prompt for services, and users with other accounts see the sign-in animation.

If you disable this policy setting, users do not see the animation and Microsoft account users do not see the opt-in prompt for services.

If you do not configure this policy setting, the user who completes the initial Windows setup see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer do not see the animation.

Note

The first sign-in animation is not displayed on Server, so this policy has no effect.

ADMX Info:

  • GP English name: Show first sign-in animation
  • GP name: EnableFirstLogonAnimation
  • GP path: System/Logon
  • GP ADMX file name: Logon.admx

Supported values:

  • 0 - disabled
  • 1 - enabled

WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark check mark check mark check mark cross mark cross mark

Scope:

  • Device

This policy setting allows local users to be enumerated on domain-joined computers.

If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers.

If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers.

Tip

This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.

You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.

The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.

ADMX Info:

  • GP English name: Enumerate local users on domain-joined computers
  • GP name: EnumerateLocalUsers
  • GP path: System/Logon
  • GP ADMX file name: logon.admx

WindowsLogon/HideFastUserSwitching

Home Pro Business Enterprise Education Mobile Mobile Enterprise
cross mark check mark2 check mark2 check mark2 check mark2 cross mark cross mark

Scope:

  • Device

Added in Windows 10, version 1703. This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or do not configure this policy setting, the Switch account button is accessible to the user in the three locations.

ADMX Info:

  • GP English name: Hide entry points for Fast User Switching
  • GP name: HideFastUserSwitching
  • GP path: System/Logon
  • GP ADMX file name: Logon.admx

The following list shows the supported values:

  • 0 (default) - Disabled (visible).
  • 1 - Enabled (hidden).

To validate on Desktop, do the following:

  1. Enable policy.
  2. Verify that the Switch account button in Start is hidden.

Footnotes:

  • 1 - Added in Windows 10, version 1607.
  • 2 - Added in Windows 10, version 1703.
  • 3 - Added in Windows 10, version 1709.
  • 4 - Added in Windows 10, version 1803.
  • 5 - Added in Windows 10, version 1809.
  • 6 - Added in Windows 10, version 1903.