Configuring Windows Authentication Client as the Only Login Method

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

By default, Windows 11 allows users to log in with a password in addition to the Windows Authentication Client. You can use a group policy or the Registry Editor to restrict login to the Windows Authentication Client only.

Requirements

Permission to edit group policy or registry settings on the Windows computer.

  1. Disable fast user switching.

    Disabling fast user switching hides the Switch User interface from the login and lock screens.

    1. To use Group Policy, open gpedit.msc, navigate to Local Group Policy > Computer Configuration > Administrative Templates > System > Logon, and set Hide entry points for Fast User Switching to Enabled.
    2. To use Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and set HideFastUserSwitching to dword:00000001.
  2. Hide the last signed-in username from the lock screen.
    1. To use Group Policy, open gpedit.msc, navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options, and set Interactive Logon: Don't display last signed-in to Enabled.
    2. To use Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and set dontdisplaylastusername to dword:00000001.