I have an Entra-joined Windows device that needs to automatically sign in with a local account at startup. The device is managed through Intune and has a few basic configuration profiles, along with the Windows Security Baseline for 25H2. None of the obvious logon settings appear to be configured.
When I run Sysinternals Autologon, it correctly writes the username, password, and AutoAdminLogon values to the registry. However, after rebooting, the AutoAdminLogon value has been changed back to 0, so automatic sign-in does not occur. I have tried different username formats, including .\localuser, the device name, and leaving the domain blank.
I have already reviewed the security baseline but could not find anything explicitly mentioning the AutoAdminLogon registry values. I am currently excluding the device from the baseline to see whether that changes the behavior. Could Credential Guard or another Intune or Entra-related security policy be disabling AutoAdminLogon? Is automatic sign-in with a local account supported on an Entra-joined device?
The device is being used as a till server, and a poorly designed application must run under an interactive logged-in user because it cannot run as a Windows service. I would prefer to keep the device enrolled through Autopilot and Intune rather than making it standalone.
2 Answers
Something is almost certainly applying a policy after Autologon writes the registry values. It could be the security baseline, a custom device configuration profile, endpoint security policy, or another management setting. Check the Intune policy reporting and local MDM event logs around the time of the reboot to identify which policy is being applied.
As a workaround, some environments configure the AutoAdminLogon registry values through policy rather than running Autologon manually, but that will only work if no security policy is deliberately enforcing AutoAdminLogon=0.
The Windows security baseline is the first thing I would suspect. It may be resetting the registry value during policy processing even if the setting is not obvious in the baseline documentation. Exclude the device from the baseline, force an Intune sync, and then reboot to see whether AutoAdminLogon remains set to 1.
Credential Guard may also interfere with this type of automatic sign-in, so check whether it is enabled and test with it disabled for this device. If you were using an Entra account rather than a local one, the usual format would be the full UPN with AzureAD as the domain, but that is separate from using .\localuser.
The account is local rather than an Entra account, so I am using .\localuser. I will first wait for the baseline exclusion to apply, then test whether Credential Guard is also involved.
There are no known Group Policies in this environment, but the behavior does feel like a policy is being applied. The device was inherited from a poorly managed setup, so I am checking the Intune profiles and will test again after removing the baseline assignment.