Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
Aliaska Varieva
Windows 11 auto login removes the sign-in check every other control assumes is there, so it belongs on kiosks and signage, not on anyone's own machine. Here are the three ways to enable it, why it stops working, the Assigned Access and Intune route, and the hardening that ships with it.
A Windows 11 machine that signs itself in has no front door, so the only question is whether that is acceptable for the box in front of you. For a lobby kiosk, a digital sign or a shop-floor terminal running one locked-down local account, it usually is. This guide covers where Windows 11 auto login belongs, the three ways to turn it on, why it stops working, and the hardening that has to ship with it.
Microsoft's own automatic logon page carries the warning in plain words: anyone who can physically reach the machine gets everything on it and every network it connects to, and with the registry method the password sits in plain text in a key that the Authenticated Users group can read remotely. That is the whole risk in one sentence. Auto login removes the check that every other control on the device assumes is there.
So the list of places it fits is short. A single-app kiosk in a lobby or a clinic waiting room. Digital signage that has to come back after a power cut with nobody on site. A point-of-sale terminal that boots straight into the register app. A lab or shop-floor station where the account can do one job and nothing else. In each case the account is local, has no admin rights, and the desktop is never the thing on screen.
Everywhere else it is the wrong answer. A staff laptop with auto login is a laptop where the lock screen, Windows Hello and MFA have all been switched off at once, and a lost bag becomes a breach. A shared office PC where everyone knows the password still needs that password typed, because the typing is what the audit log, BitLocker and conditional access are built around. If the account on the box has rights anywhere else, the least-privilege rules that apply to every other login apply here twice.
netplwiz. Run netplwiz, or control userpasswords2, the older name for the same dialog, select the account, clear "Users must enter a user name and password to use this computer", and enter the password twice. On Windows 11 that checkbox is often missing. Windows Hello hides it when the sign-in option "For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device" is on. Turn that off under Settings, Accounts, Sign-in options, and the box comes back. The same switch lives in the registry at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device, value DevicePasswordLessBuildVersion, set to 0, which is the handle for scripting it. Whatever you click in netplwiz, the result is the same registry change as the next method, plain-text password included.
The Winlogon registry keys. Under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, set AutoAdminLogon to 1, DefaultUserName to the account, DefaultPassword to its password, and on a domain-joined machine DefaultDomainName to the domain's FQDN. If DefaultPassword is missing, Windows flips AutoAdminLogon back to 0 on its own. This is the method that scales through Group Policy preferences, and the one that puts the password where any authenticated user on the network can read it.
Sysinternals Autologon. Mark Russinovich's Autologon tool writes the same AutoAdminLogon and DefaultUserName values but stores the password as an LSA secret, encrypted, instead of a plain string. The page is blunt about the limit: a user with administrative rights can still retrieve and decrypt it. The tool does not verify the credentials you type, so a typo means a machine that boots to a failed logon. The command line is autologon user domain password, and holding Shift during boot skips the automatic logon for that one start.
The thread above, from September 2025, is the working pattern in one reply: the Winlogon keys pushed by GPO so nobody on site needs the password, plus a logoff task that reboots the machine so a sign-out never leaves it stranded at the lock screen. The Group Policy editor is where both of those get built.
The ticket is always the same: the kiosk is sitting at the login screen. Microsoft's page and the thread above list the usual causes, and none of them is the tool.
Someone signed in as a different user at the console. Windows rewrites DefaultUserName to the last account that logged on, so the next boot tries that account with the stored password and fails. A shutdown script that resets the value fixes it.
The machine was imaged and the keys were set too early. A lingering sysprep or OOBE process flips AutoAdminLogon back to 0 on the first reboot or two. Reboot twice after imaging, then set the keys.
A logon banner is in force. If the interactive logon message is set by GPO or local policy, auto logon does not run until the banner is removed. Exchange ActiveSync password policies on the device stop it too, by design.
The device is Entra-joined only. Windows attempts the logon before the network is up, and Microsoft's page says there is no setting to delay it, so the attempt fails. Domain-joined machines can use the "Always wait for the network at computer startup and logon" policy. Entra-only machines cannot, which is the case that drives people to Assigned Access.
That plain-text password is also why the registry route gets found by the wrong people. Exported, it reads like this.
If the box is a kiosk, do not hand-build the auto login. Windows has a feature for it. Settings, Accounts, Other users, Set up a kiosk creates a local standard account, assigns one app to it, and signs that account in on every boot with no password stored by you at all. Microsoft's kiosk quickstart describes the result: after the reboot, a local user account is automatically signed in and the app opens. Close the app and it restarts. The desktop never appears, and a break-out key sequence (Ctrl+Alt+Del unless you set another) is how a technician gets back in.
Intune does the same at fleet scale through the kiosk profile. The user logon type "Auto logon" uses the AssignedAccess CSP to create and sign in its own local account, and "Local user account" lets you name one you created. Entra accounts are the catch. As the r/Intune thread below found while moving more than 100 kiosks from hybrid to cloud-only, auto logon with an Entra user is not supported, and a local account created during Autopilot is the working pattern. The same thread carries the other lesson: a script that touches the Winlogon keys during the Autopilot phase breaks the enrollment, so assign it after the sign-in screen appears.
The payoff is that Assigned Access carries its own hardening. The kiosk account cannot reach the desktop, Settings or a file dialog, which is most of the checklist in the next section done for you. If the fleet mixes platforms, iPad kiosk mode is the same idea on Apple hardware, and the walkthrough below shows the Windows side from Settings to first boot.
Auto login is one line on the build sheet, and the rest of the sheet is what makes it acceptable.
The account is local and standard, never an admin and never a domain user with rights anywhere else. The app it runs is locked with Assigned Access or Shell Launcher so the desktop is never on screen, which also settles the screen timeout question, because the kiosk app owns the display. The disk is encrypted with BitLocker and a TPM, because an unencrypted drive with the Winlogon key on it hands the password to anyone with a screwdriver. RDP is off and the firewall blocks inbound, since the remote registry read Microsoft warns about needs a path to the box. IgnoreShiftOverride set to 1 under the same Winlogon key stops the Shift trick at a public screen. The box is physically locked, spare USB ports are blocked, and its network port sits in a VLAN of its own.
Then inventory it. A script that reads the Winlogon key on every device and reports where AutoAdminLogon is 1 and DefaultPassword exists turns the unknown into a list. On OpenFrame that is a script run across a client's devices with the output collected, so the kiosk someone enabled in 2023 shows up next to the ones you built on purpose.
Windows 11 auto login is a kiosk feature that happens to work on any PC. Use Assigned Access or the Intune kiosk profile when the box is a kiosk, Sysinternals Autologon or GPO-pushed Winlogon keys only when it cannot be, and never on a machine a person uses as their own. Pair it with a local standard account, BitLocker, no inbound access and a physical lock, and keep the exceptions on a list you can read.
If the real goal was to stop a Microsoft account from being the sign-in, removing the Microsoft account is the fix. If the auto-login account has rights it should not, changing the administrator is where to move them.
Head of Platform
Hi! I’m Aliaska, and I’ve been working as a software engineer (mostly Java + a bit Kotlin) for over 8 years now. I mostly spend my time building backend services, integrating systems, fixing bugs (the fun part 🙃), and making sure things don’t fall apart behind the scenes.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.