none
Windows 8.1 Group Policy to Force Domain Logon as Default?

    Question

  • I recently purchased a new Windows 8.1 computer for use in our organization.  The default logon option for the device is for a Microsoft Account (the default username field prompt is for an e-mail address, rather than for a username.)  However, I would prefer that the default logon option be for a Windows domain account logon, so that users don't have to click the "Sign-in options" link and select "Local or domain account password" each time they need to log onto the computer.

    I have learned that setting the "Interactive logon:  Do not display last user name" policy (located under Computer Configuration / Policies / Windows Settings / Security Settings / Local Policies / Security Options) to Disabled allows the domain logon option to be retained across sessions.  However, I would prefer to keep this option set to Enabled so that the previous user name is not displayed.

    Does anyone have any suggestions on how the default logon option can be forced to a domain logon, while still suppressing the display of the last username?

    • Edited by Arowitv Monday, March 31, 2014 3:07 PM
    Monday, March 31, 2014 3:06 PM

Answers

  • Hi Arowitv,

    According to your description, we can use the following policy to check the result.

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options: Accounts: Block Microsoft accounts

    Click this option, and select" Users can't add or log on with Microsoft account"

    Note: Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system.

    Computer Configuration\Administrative Templates\System\Logon :Assign default domain for logon

    Set the option to Enabled, and add the Default Logon domain.

    Hope this helps.

    Regards,


    Kelvin Xu
    TechNet Community Support


    Wednesday, April 2, 2014 6:18 AM
    Moderator

All replies

  • Hi Arowitv,

    According to your description, we can use the following policy to check the result.

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options: Accounts: Block Microsoft accounts

    Click this option, and select" Users can't add or log on with Microsoft account"

    Note: Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system.

    Computer Configuration\Administrative Templates\System\Logon :Assign default domain for logon

    Set the option to Enabled, and add the Default Logon domain.

    Hope this helps.

    Regards,


    Kelvin Xu
    TechNet Community Support


    Wednesday, April 2, 2014 6:18 AM
    Moderator
  • I was able to try your second option, but on my Win 8.1 laptop it still requires me to click sign-in options and click the left key icon which the tooltip is "Local or domain account password".

    The first option you say "Accounts: Block Microsoft accounts" is not even an option in my security options.  I am on a Server 2008 R2 level domain.

    Please help.

    Tuesday, April 7, 2015 12:04 PM
  • You need to download and install ADMX template for windows server 2012 R2 update.

    under security option: Accounts: Block Microsoft accounts i choose

    "Users can’t add or log on with Microsoft accounts" and "Sign-in Options" is no longer appear on the login screen nor as a login option.

    Regards.

    Faisal

    Wednesday, April 22, 2015 8:08 AM
  • All of this works great for Windows 8.1 now with the proper GPO's in place.  However has anyone found a solution for Windows 10?

    In Windows 10 I have to click on "Local or domain account password" in the lower left corner.  Once this is clicked on, the center of the screen has a square tile with a key icon with username and password fields.  By default "Other user" is highlighted in the lower left, and in the middle is a circle person icon with the text Other user under it, but nothing to type in.

    Monday, September 28, 2015 3:22 PM