Windows 10: Enable Show Local Users on Sign-in Screen on Domain Joined Windows 10

How to: Enable Show Local Users on Sign-in Screen on Domain Joined Windows 10

How to Enable or Disable Show Local Users on Sign-in Screen on Domain Joined Windows 10 PC


A network based on a Domain provides centralized administration of the entire network from a single computer which is called a server. A Domain provides single user login from any computer connected to that network within the network perimeter. Users are allowed (or restricted) to access resources depending upon the permissions they have.

By default, local user accounts are not shown (enumerated) on the sign-in screen on domain-joined computers. Only domain accounts will show on the sign-in screen by default on domain-joined computers.

This tutorial will show you how to enable or disable showing all local users on the sign-in screen on a domain joined Windows 10 PC.

*note You must be signed in as an administrator to enable or disable enumerate local users on sign-in screen on domain-joined computers.


CONTENTS:

• Option One: Enable or Disable Show Local Users on Sign-in Screen on Domain Joined PC in Local Group Policy Editor
• Option Two: Enable or Disable Show Local Users on Sign-in Screen on Domain Joined PC using a REG file

EXAMPLE: Default disable showing local accounts on sign-in screen on domain-joined Windows 10 PC









OPTION ONE [/i] Enable or Disable Show Local Users on Sign-in Screen on Domain Joined PC in Local Group Policy Editor
*note The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option TWO below.
1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\System\Logon




3. In the right pane of Logon in Local Group Policy Editor, double click/tap on the Enumerate local users on domain-joined computers policy to edit it. (see screenshot above)

4. Do step 5 (enable) or step 6 (disable) below for what you would like to do.


5. To Enable Show Local Users on Sign-in Screen on Domain Joined PC
A) Select (dot) Enabled, click/tap on OK, and go to step 7 below. (see screenshot below)

6. To Disable Show Local Users on Sign-in Screen on Domain Joined PC
A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)

*note Not Configured is the default setting.




7. When finished, you can close the Local Group Policy Editor if you like.





OPTION TWO [/i] Enable or Disable Show Local Users on Sign-in Screen on Domain Joined PC using a REG file
*note The downloadable .reg files below will add and modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System

EnumerateLocalUsers DWORD

(delete) = Disable
1 = Enable


1. Do step 2 (enable) or step 3 (disable) below for what you would like to do.


2. To Enable Show Local Users on Sign-in Screen on Domain Joined PC
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Enable_show_local_users_on_sign-in_screen_on_domain-joined_computers.reg

Download

3. To Disable Show Local Users on Sign-in Screen on Domain Joined PC
*note This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Disable_show_local_users_on_sign-in_screen_on_domain-joined_computers.reg

Download
4. Save the .reg file to your desktop.

5. Double click/tap on the downloaded .reg file to merge it.

6. When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

7. You can now delete the downloaded .reg file if you like.

That's it,
Shawn


Related Tutorials

• How to Join a Windows 10 PC to a Local Active Directory Domain
• How to Remove a Windows 10 PC from a Local Active Directory Domain
• How to Enable or Disable Domain Users to Sign in to Windows 10 using Biometrics
• How to Enable or Disable Domain Users to Sign in with PIN to Windows 10
• How to Enable or Disable Domain Users to Sign in with Picture Password to Windows 10
• How to Enable or Disable Don't Display Username at Sign-in in Windows 10
• How to Do Not Display Last Signed-in User Name on Sign-in Screen in Windows 10
• How to Hide or Show Your Email Address on Sign-in Screen in Windows 10
• How to Allow or Prevent Users and Groups to Sign in Locally to Windows 10
• How to Deny Users and Groups to Sign in Locally to Windows 10

:)

 

Remove one of the "Other user" login options from login screen

Hello Cruz, and welcome to Ten Forums. *Smile

You might see if the tutorial below to disable showing local users on the sign-in screen on domain joined computers may work for this for you.

*Arrow Enable Show Local Users on Sign-in Screen on Domain Joined Windows 10

 

Domain Joined Windows 10 - Fast User Switching


When signing in to a Windows PC which has joined a domain with other than a domain account, you need to use a so called full username (ComputerName\UserProfileName).




In above screenshot example I simply replaced the default domain username with the credentials of a local account using the full username and can now sign in using those credentials.

Clicking the link How do I sign in to another domain shows these instructions:

 

How to display multiple local user accounts at login screen?


Hi johngalt, thank you for you suggestion: I did enable 'Enumerate local users on domain-joined computer', however the result remained identical. The login screen just shows the last user logged in and the 'Other' option ...

 

Join Windows 10 PC to a Domain  

That would explain it.

Active Directory is the way, the tool local domains use for user control and management. There are three different methods a user / device can join AD: joining local domain and signing in with domain credentials, joining through Azure AD and signing in with Azure AD credentials, and the "lowest level" so called workplace join, connect a local or Microsoft sign-in account to an Azure AD (workplace) account.

Joining a local domain and Azure AD basically is the same. Of course there are administrative differences from IT departement's point of view, but for the most the only difference end user sees is the sign-in credentials.

Once you have joined a local domain, you cannot join Azure AD, and vice versa. It's one or the other.

Joining Azure AD instead of joining a domain is in my opinion the future, Microsoft's clear goal being to get corporate users to move from local domains and on-premises domain controllers to Azure AD. I posted an opinion piece about that just a few days ago on my site: Secure Windows on a Secure Device Win10.Guru

Azure AD gives you two levels to join: Workplace join simply adds your Azure AD account to Windows 10 for single-sign-on to all your workplace services, but you will continue signing in to Windows with your current local or Microsoft account:




This will be shown as a connected account:




As you will continue signing in with your local or Microsoft account, you are still pretty much in control. You can use workplace services, company store and such but IT admin cannot set up any restrictions on your device. A workplace joined user / device can still join a local domain.

If you select Join Azure AD instead, your sign-in account will be changed to Azure AD account. This is shown as Azure AD joined:




Once joined to Azure AD, joining a local domain is no longer possible.

I'm not sure if the above explains this clear enough. The point is, a local domain and Azure AD effectively chooses the way you are joined to your workplace. Only one of these methods to join can be used.

 

Created local account, but unable to login.

I am trying to create a local account on my Win10 Pro machine. I have gone through the various steps and have an account created, but I have no option to login to that account.

I can see the user in Local Users and Groups (not disabled), but the name does NOT appear on the login screen. Furthermore, the login screen gives me options for email + password (not applicable) OR username + PIN (no option to create a PIN when creating
a local user). Even if I type the username and "Forgot PIN", it says the username is not valid.

I'm pretty much out of ideas.

UPDATE:

Ok. Figured it out... there is a group policy that, by default, turns off local users on the login screen when the computer is attached to a domain. See:

How to Enable or Disable Show Local Users on Sign-in Screen on Domain Joined Windows 10 PC