Default Windows 7 logon screen to a specific user's account

[MyHD4870x2Melted]

I am currently working on a domain and we have some individuals that cannot be bothered to check the login name before they start hacking away at the password and locking accounts.
I managed to keep the last login from being displayed but that also leaves the username blanks and they can't remember the username or do not realize that it is blank so I still get calls about not being able to log in.
I have asked around and people do not seem to get what I am wanting to do for some reason...

-It is windows 7, not xp
-Domain user not local user
-Needs to default to a different user for each computer. so Bob's computer can be set to Bob's login
-Must Default back to the correct login on startup and after other users log out.
-DO NOT WANT TO AUTO-LOGIN
-No, I can run a script every time someone logs out of another person's PC.
-No, I can't just get new users unfortunately.

 

[USAFRet]

-No, I can't just get new users unfortunately.

That is what you need...

But having a specific login screen for each person won't help if they just blow off the username, or forget it.

This is a management problem, not a technical problem.
"If IT has to reset your account more than 1x/week, your pay will be docked 1 hour for each instance. Remember your username and password, people."

 

[martinch]

Just in case I've misunderstood ... you want to specify the default user for a given PC, so when someone goes to log in, it defaults to that account? You should be able to do this via Group Policy, e.g. https://social.technet.microsoft.com/Forums/windowsserver/en-US/d7cdcd95-794d-4f6b-9646-c17b29b9fdd6/how-to-set-default-username-with-gpo?forum=winserverGP

I'm guessing you'll probably need a group policy item for each PC, some way of calculating the username based on the machine name, etc.

 

[USAFRet]

Just in case I've misunderstood ... you want to specify the default user for a given PC, so when someone goes to log in, it defaults to that account? You should be able to do this via Group Policy, e.g. https://social.technet.microsoft.com/Forums/windowsserver/en-US/d7cdcd95-794d-4f6b-9646-c17b29b9fdd6/how-to-set-default-username-with-gpo?forum=winserverGP

I'm guessing you'll probably need a group policy item for each PC, some way of calculating the username based on the machine name, etc.

That's what I got too, but it seems other people may also use this PC.

So if Mary has to use Bob's PC...it is defaulted to Bob's login.
Mary, being an idiot, does not pay attention to the default username and attempts to input her password on Bob's login. Eventually locking it.

 

[MyHD4870x2Melted]

LMAO!
Here is what I want....
We press the power button on Bob's computer.
Computer starts up > Alt+Ctl+Delete(as it is now) > User Name is automatically set to Bob's domain login name, password is blank.
So Bob could just type his password and log in.
I decide to login, so I "switch users" and enter my domain login and password.
I get finished and log out.
Username goes back to Bob's domain login name and not my login account.

Right now, if I were to remote into someone's PC and work on it, after I get finished and log out, my user name shows up in the user name box on the login screen because i was the last to login. Bob comes over to the computer and enters his password 5 times wondering why it isn't working and I get locked out.
See the issue.

 

[USAFRet]

How about this:

Do not display last username in Logon Screen in Windows 10 / 8 / 7
http://www.thewindowsclub.com/make-windows-7-8-use-classic-logon-screen

Blank, and Bob must enter his username/password to gain access.

(If Bob 'forgets', see above management policy)

 

[MyHD4870x2Melted]

Just in case I've misunderstood ... you want to specify the default user for a given PC, so when someone goes to log in, it defaults to that account? You should be able to do this via Group Policy, e.g. https://social.technet.microsoft.com/Forums/windowsserver/en-US/d7cdcd95-794d-4f6b-9646-c17b29b9fdd6/how-to-set-default-username-with-gpo?forum=winserverGP

I'm guessing you'll probably need a group policy item for each PC, some way of calculating the username based on the machine name, etc.

-Enabled "do not display last login" in GPEDIT
-REGEDIT > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-Changed DefaultUserName to Domain\User
-Rebooted and the username was blank.
-Logged on with the account, logged off, user name was blank.

 

[USAFRet]

Just in case I've misunderstood ... you want to specify the default user for a given PC, so when someone goes to log in, it defaults to that account? You should be able to do this via Group Policy, e.g. https://social.technet.microsoft.com/Forums/windowsserver/en-US/d7cdcd95-794d-4f6b-9646-c17b29b9fdd6/how-to-set-default-username-with-gpo?forum=winserverGP

I'm guessing you'll probably need a group policy item for each PC, some way of calculating the username based on the machine name, etc.

-Enabled "do not display last login" in GPEDIT
-REGEDIT > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-Changed DefaultUserName to Domain\User
-Rebooted and the username was blank.
-Logged on with the account, logged off, user name was blank.

Right. This requires Bob and Mary to have more that 2 functioning brain cells each, to remember their username/password.

Scenario:
You remote in, do your thing, log off
It defaults back to Bob login
Mary jumps on it, and being an idiot, gets the account locked.

or

You remote in, do your thing, log off
It defaults back to blank login
Bob jumps on it, and being an idiot, can't remember his username.

It's tough to have it both ways. Bob/NotBob.

 

[MyHD4870x2Melted]

Just in case I've misunderstood ... you want to specify the default user for a given PC, so when someone goes to log in, it defaults to that account? You should be able to do this via Group Policy, e.g. https://social.technet.microsoft.com/Forums/windowsserver/en-US/d7cdcd95-794d-4f6b-9646-c17b29b9fdd6/how-to-set-default-username-with-gpo?forum=winserverGP

I'm guessing you'll probably need a group policy item for each PC, some way of calculating the username based on the machine name, etc.

-Enabled "do not display last login" in GPEDIT
-REGEDIT > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-Changed DefaultUserName to Domain\User
-Rebooted and the username was blank.
-Logged on with the account, logged off, user name was blank.

Right. This requires Bob and Mary to have more that 2 functioning brain cells each, to remember their username/password.

Scenario:
You remote in, do your thing, log off
It defaults back to Bob login
Mary jumps on it, and being an idiot, gets the account locked.

or

You remote in, do your thing, log off
It defaults back to blank login
Bob jumps on it, and being an idiot, can't remember his username.

It's tough to have it both ways. Bob/NotBob.

LMAO exactly.
I need Bob's computer to default to Bob and Mary's to default to Marry.
Doesn't have to be this way for every PC just for select people.
Mary does not get on Bobs computer but IT and Management do.
IT and Management are smart enough to look at the username, Bob and Mary are not.
If Bob locks out Management because he cannot check the username, IT gets yelled at because IT should have prevented it from happening.
Bob gets a cookie...

 

[USAFRet]

Default it to Blank on logoff. Everyone gets the same experience. Bob and Mary will just have to figure it out.

 

[martinch]

Default it to Blank on logoff. Everyone gets the same experience. Bob and Mary will just have to figure it out.

Can't see a way to give the solution requested, I'm afraid, but the above would appear to be the "most common" approach (it's what we have where I work).

 

[MyHD4870x2Melted]

X.x meant to pick USAFRet's as the best answer.

I told the floor manager that it couldn't be done and that I would just have to put a sticker with their login names on their monitors or just do an auto login because they would have both name and password listed on the monitors so it kind of defeats the point.

I was told "no" I have to set it up exactly how they want it. They have to have a password, the password must be listed on the monitors and the computers must default to the individuals account. They said I needed to "stop f**king around with it and get it done."

 

[USAFRet]

X.x meant to pick USAFRet's as the best answer.

I told the floor manager that it couldn't be done and that I would just have to put a sticker with their login names on their monitors or just do an auto login because they would have both name and password listed on the monitors so it kind of defeats the point.

I was told "no" I have to set it up exactly how they want it. They have to have a password, the password must be listed on the monitors and the computers must default to the individuals account. They said I needed to "stop f**king around with it and get it done."

The password must be written on the monitor?
That is all kinds of [strike]stupid[/strike] wrong.


If we were to default to Bob login username, and Bob's password is written right there... Of what use is a password?

 

[logainofhades]

That is when you tell them that is a security risk. Passwords on the monitor is a very insanely bad idea.

 

[Onus]

X.x meant to pick USAFRet's as the best answer.
.
.
.

Fixed for you (even Mods cannot choose their own posts for BA).

 

[Onus]

Default it to Blank on logoff. Everyone gets the same experience. Bob and Mary will just have to figure it out.

If they, or Manglement, are unable to figure this out, they should be advised that Wal-Mart is hiring.

 

[MyHD4870x2Melted]

I have figured out a solution, even if it's a messy one.
I know that it can be done, I just have to figure out the correct script.
I should be able to create a .bat file with a script to change the LastLoggedOnSAMUser/LastLoggedOnUser in the registry then assign it to run on logoff in global policy. Then I can change the user name in each .bat file so no mater who logs on, when they log off it will show the name I want as the last person who logged on.

 

[ScrewySqrl]

yay! at least that works. If Brute Force doesn't work, you aren't using enough.

Password written on the monitor strikes me as a VERY, VERY bad idea.

 

[USAFRet]

yay! at least that works. If Brute Force doesn't work, you aren't using enough.

Password written on the monitor strikes me as a VERY, VERY bad idea.

Yup.
"How to get a coworker fired in 3 easy steps"
1. Sit down at Bob's PC
2. Logon, as Bob, with Bob's password
3. Alter some figures on the accounting spreadsheet (or even more subtle, alter the underlying formula/calculation)

All fingers point back to Bob.

 

[MyHD4870x2Melted]

yay! at least that works. If Brute Force doesn't work, you aren't using enough.
Password written on the monitor strikes me as a VERY, VERY bad idea.

A Most of the stuff they want to do is a bad idea lol.

My final solution!

I disabled "interactive login: do not show last user name" in gpedit.msc

I created a .bat file

call reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnSAMUser /t REG_SZ /d "Domain\Bob" /f
call reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v LastLoggedOnUser /t REG_SZ /d "Domain\Bob" /f

Placed in C:\Windows\System32\GroupPolicy\User\Scripts\Logoff

In gpedit.msc I set my .bat file as a log off script.

Result: partial success! It changes the login name after my administrator account logs out, but it will not change it when a standard user logs out.

 

[hang-the-9]

Change the registry value to the people that can't remember their names, set the rights on that registry key so that no-one has rights to write to it. This may or may not break Windows and may prevent other users from logging on if Windows tries to write to that key and can't.

Don't you have a manager that can explain to whoever is saying this HAS to be done that it can't be, or is not worth doing?

You can also set them up with this, assuming they know what a finger is to use it http://windows.microsoft.com/en-us/windows7/can-i-use-a-fingerprint-reader-with-windows

 

[MyHD4870x2Melted]

Thanks hang-the-9, but unfortunately most of the problems come from the shop floor so a finger print scanner might not work... They have dirty thumbs lol.
I made my .bat file and Logoff script part of my Master System Image (play LoZ tune).
I left the spot in the script for domain/username blank and only change it for systems out on shop floor.
Now when an Admin(me) or Management(has admin rights to the registry) log off of any shop floor computer the name will change back to whatever login name I set. As for everyone else, it is left blank. Now no one knows if it was an admin or management snooping through their PC, or if the username just got deleted from the text box.