Home

Can't add local user "Guest" account to login screen

%3CLINGO-SUB%20id%3D%22lingo-sub-202688%22%20slang%3D%22en-US%22%3ECan't%20add%20local%20user%20%22Guest%22%20account%20to%20login%20screen%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-202688%22%20slang%3D%22en-US%22%3E%3CDIV%3E%3CFONT%3EI%20must%20be%20losing%20my%20mind.%20I%20have%20Azure%20AD%20joined%20Windows%2010%20machines%20(corporate%20ownership%20model)%2C%20but%20I%20would%20like%20to%20add%20a%20persistent%20local%20guest%20user%20login%20to%20the%20login%20screen%2C%20and%20I%20can't%20seem%20to%20do%20it.%20I%20can%20add%20the%20user%2C%20but%20it%20doesn't%20appear%20as%20a%20choice%20on%20the%20login%20screen.%20Only%20%22Other%20user...%22%20appears%20(along%20with%20whoever%20last%20logged%20on).%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EFirst%20I%20tried%20what%20I%20have%20done%20historically%20-%20via%20%22lusrmgr.msc%22%20and%20enabled%20the%20built-in%20Guest%20account.%20No%20password%2C%20can't%20change%20password%2C%20etc...AFAIK%20doing%20this%20would%20result%20in%20a%20new%20%22Guest%22%20login%20appearing%20on%20the%20login%20screen%2C%20but%20alas%20it%20does%20not.%20FWIW%20it%20doesn't%20work%20for%20the%20built-in%20administrator%20account%20either.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EI%20also%20tried%20another%20approach%20-%20using%20Windows%2010%20%22Settings--%26gt%3BAccounts--%26gt%3BOther%20Users--%26gt%3BAdd%20someone%20else%20to%20this%20PC%22%20and%20added%20a%20local%20standard%20user%20without%20a%20MS%20Account%20or%20password%2C%20and%20while%20that%20adds%20the%20account%20(I%20see%20the%20profile%20created%20under%20the%20user%20folder%2C%20and%20the%20user%20has%20been%20added%20to%20the%20local%20users'%20group%20according%20to%20%22lusrmgr.msc%22%2C%20and%20I%20then%20added%20this%20new%20user%20to%20the%20%22guests%22%20group%20and%20removed%20from%20%22users%22%2C%20but%20it%20doesn't%20actually%20appear%20on%20the%20login%20screen%20like%20I%20thought%20it%20used%20to.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EI%20then%20tried%20using%20the%20Windows%20Config%20Designer%20app%20to%20create%20a%20%22Shared%20Computer%22%20provisioning%20package%20-%20and%20while%20this%20sort%20of%20worked%20(a%20new%20Guest%20account%20was%20added%20to%20the%20login%20screen)%20it%20seemed%20to%20wipe%20out%20other%20critical%20settings%20on%20the%20computer%2C%20like%2C%20for%20example%2C%20Windows%20Hello%20sign-in%20settings%20got%20wiped%20out%20for%20the%20computer%20owner.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EWhat%20am%20I%20missing%3F%20At%20first%20I%20thought%20it%20was%20perhaps%20a%20Windows%20version%20issue%20(Insider%20vs.%20release)%20or%20Intune%20policy%20conflict%2C%20but%20I%20have%20tried%20this%20now%20on%20other%20tenants%20with%20and%20without%20Intune%20that%20are%20cloud-only%20Azure%20AD%20joined%20devices%20and%20I%20can't%20get%20it%20to%20work%20anywhere.%20This%20used%20to%20be%20so%20simple.%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EAnyone%20else%20able%20to%20do%20this%3F%3C%2FFONT%3E%3C%2FDIV%3E%3CDIV%3E%3CFONT%3EThanks%2C%3CBR%20%2F%3EBob%3CBR%20%2F%3E%3C%2FFONT%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-202688%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Elocal%20user%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ELogin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Elogin%20screen%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EUsers%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360937%22%20slang%3D%22en-US%22%3ERe%3A%20Can't%20add%20local%20user%20%22Guest%22%20account%20to%20login%20screen%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360937%22%20slang%3D%22en-US%22%3E%3CP%3EYour%20Guest-User%20is%20a%20local%20account%20and%20your%20machine%20is%20domain%20joined.%20By%20default%20local%20users%20are%20not%20enumerated%20on%20the%20logon%20screen%20for%20domain%20joined%20machines.%3C%2FP%3E%3CP%3EThis%20group%20policy%20should%20help%20you%20achieve%20what%20you%20want%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3E%3CFONT%3EComputer%20Configuration%5CAdministrative%20Templates%5CSystem%5CLogon%5CEnumerate%20local%20users%20on%20domain-joined%20computers%3C%2FFONT%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CFONT%3EFor%20Azure-AD%20joined%20computers%20you%20may%20need%20to%20set%20this%20policy%20locally%20(gpedit.msc).%20I'm%20not%20sure%20if%20a%20similar%20setting%20exists%20with%20MDM-policies.%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360857%22%20slang%3D%22en-US%22%3ERe%3A%20Can't%20add%20local%20user%20%22Guest%22%20account%20to%20login%20screen%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360857%22%20slang%3D%22en-US%22%3E%3CP%3EBob%2C%20I%20have%20a%20similar%20issue.%20I've%20posted%20a%20similar%20question%20in%20the%20Azure%20AD%20community.%20Hopefully%20one%20of%20us%20gets%20an%20answer.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Active-Directory%2FLogin-with-a-local-user-account-on-Azure-AD-joined-Windows-10%2Fm-p%2F360851%23M2628%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Active-Directory%2FLogin-with-a-local-user-account-on-Azure-AD-joined-Windows-10%2Fm-p%2F360851%23M2628%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Bob Manjoney
Regular Contributor
I must be losing my mind. I have Azure AD joined Windows 10 machines (corporate ownership model), but I would like to add a persistent local guest user login to the login screen, and I can't seem to do it. I can add the user, but it doesn't appear as a choice on the login screen. Only "Other user..." appears (along with whoever last logged on).
 
First I tried what I have done historically - via "lusrmgr.msc" and enabled the built-in Guest account. No password, can't change password, etc...AFAIK doing this would result in a new "Guest" login appearing on the login screen, but alas it does not. FWIW it doesn't work for the built-in administrator account either.
 
I also tried another approach - using Windows 10 "Settings-->Accounts-->Other Users-->Add someone else to this PC" and added a local standard user without a MS Account or password, and while that adds the account (I see the profile created under the user folder, and the user has been added to the local users' group according to "lusrmgr.msc", and I then added this new user to the "guests" group and removed from "users", but it doesn't actually appear on the login screen like I thought it used to.
 
I then tried using the Windows Config Designer app to create a "Shared Computer" provisioning package - and while this sort of worked (a new Guest account was added to the login screen) it seemed to wipe out other critical settings on the computer, like, for example, Windows Hello sign-in settings got wiped out for the computer owner.
 
What am I missing? At first I thought it was perhaps a Windows version issue (Insider vs. release) or Intune policy conflict, but I have tried this now on other tenants with and without Intune that are cloud-only Azure AD joined devices and I can't get it to work anywhere. This used to be so simple.
 
Anyone else able to do this?
Thanks,
Bob
2 Replies
Highlighted

Bob, I have a similar issue. I've posted a similar question in the Azure AD community. Hopefully one of us gets an answer.

 

https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Login-with-a-local-user-account-on-Azu...

Highlighted

Your Guest-User is a local account and your machine is domain joined. By default local users are not enumerated on the logon screen for domain joined machines.

This group policy should help you achieve what you want:

 

Computer Configuration\Administrative Templates\System\Logon\Enumerate local users on domain-joined computers

 

For Azure-AD joined computers you may need to set this policy locally (gpedit.msc). I'm not sure if a similar setting exists with MDM-policies.