We have about 300 shared Windows PCs in a healthcare setting, and users need to sign in with their own accounts. Returning users get to the desktop in under 15 seconds, but a user signing in to a PC for the first time spends about 30 seconds on โPreparing Windows.โ We use Intune and FIDO2 security keys, and have ruled out VDI and shared generic accounts. What should we investigate, and are mandatory profiles worth considering?
Any good way to shorten the first sign-in on shared Windows PCs?
Answers
First, find out what is actually happening during that screen rather than removing more Windows components by guesswork. Compare a first sign-in with a returning one, collect sign-in and policy timing data, and check whether user policies, scripts, profile initialization, or app registration are taking the time. The difference between first and later sign-ins points toward per-user setup, but it does not identify the exact cause by itself.
Also verify whether Intune policies or enrollment status behavior are still applying at sign-in. A policy that skips or changes a preparation screen may affect one phase without making the underlying work disappear, so test it on a small group and measure the full time to a usable desktop.
Reply to this answer
Thirty seconds for a new local profile is not automatically a sign that something is broken. The useful question is whether users are waiting on ordinary profile creation or on something your configuration adds. Check the event logs and capture a trace around sign-in, then compare a clean test device with one carrying the production policy set.
I would be cautious about disabling provisioning or changing profile-related registry settings until you can tie them to a measured delay. Those changes can make troubleshooting harder, and may not help if the wait is from another part of first-use setup.
Reply to this answer
Mandatory profiles could fit if users truly do not need anything saved between sessions, but they are not a guaranteed speed fix. They change how the profile behaves and can introduce their own maintenance and compatibility work. Test the complete sign-in and sign-out experience with the apps and settings users actually need before deciding.
You can scope a profile policy to the shared-device group rather than the standard machines, but confirm that the device targeting and user experience behave as intended. Keep the existing profile path available during the pilot so you can compare results and roll back cleanly.
4N__Torsion:
Would you test mandatory profiles only on those shared PCs, even when the same staff also use their own dedicated machines?
Reply to this answer
Before changing profile types, check whether the first-use delay is tied to user-targeted scripts, app deployment, or policy processing. Use sign-in diagnostics to identify the slow phase and look for differences between a userโs first and later logons. If you can reproduce it with a minimal policy set, add settings back in batches until the delay returns.
That takes longer than flipping a tweak, but it gives you a fix you can explain and maintain across 300 devices.
Reply to this answer
If the only goal is shaving a few seconds, be careful not to trade away security or create a profile setup that is fragile. A clean, controlled pilot is the way to answer whether skipping a screen or using a mandatory profile actually improves time to a ready desktop. Measure several users and machines, not just one fast test.
Reply to this answer
Add your answer
Answers are reviewed before publication.
8L__Muffet:
That makes sense. The slowdown is specifically for a userโs first sign-in on a machine, not the first sign-in after imaging.