Accounts Enable or Disable Auto Sign-in and Lock after Update or Restart in Windows 11

This tutorial will show you how to enable or disable automatically sign in and lock last user after an update or restart in Windows 11.

You can speed up the Windows sign-in process by turning on Use my sign in info to automatically finish setting up after an update to automatically sign in and set up your PC after an update or restart. Windows will then lock your device to help keep your account and personal info safe.

During a Windows Update, there are user specific processes that must happen for the update to be complete. These processes require the user to be logged in to their device. On the first login after an update has been initiated, users must wait until these user specific processes are complete before they can start using their device.

When Windows Update initiates an automatic reboot, ARSO (Winlogon automatic restart sign-on) extracts the currently logged in user's derived credentials, persists it to disk, and configures Autologon for the user. Windows Update running as system with TCB privilege will initiate the RPC call to do this.

After the final Windows Update reboot, the user will automatically be logged in via the Autologon mechanism, and the user's session is rehydrated with the persisted secrets. Additionally, the device is locked to protect the user's session. The locking will be initiated via Winlogon whereas the credential management is done by the Local Security Authority (LSA). Upon a successful ARSO configuration and login, the saved credentials are immediately deleted from disk.

By automatically logging in and locking the user on the console, Windows Update can complete the user specific processes before the user returns to the device. In this way, the user can immediately start using their device.

If you enable Use my sign-in info to automatically finish setting up after an update for your account, it will disable getting the "Someone else is still using this PC. If you restart now, they could lose unsaved work" message when any user restarts the computer while your account is still signed in.

If you enable the Sign-in and lock last interactive user automatically after a restart policy for all users, it will disable getting the "Someone else is still using this PC. If you restart now, they could lose unsaved work" message when any user restarts the computer while any account is still signed in.

References:

This option isn’t available if your device is joined to a domain, or if work or email policies are applied to your device by your organization.

1 Open Settings (Win+I).

2 Click/tap on Accounts on the left side, and click/tap on Sign-in options on the right side. (see screenshot below)



3 Under Additional settings, turn on (default) or off Use my sign-in info to automatically finish setting up after an update for what you want. (see screenshot below)


4 You can now close Settings if you like.

This option is for the same setting in Option One, but set manually for a specific user(s) in Registry Editor instead.

You must be signed in as an administrator to use this option.

1 Open an Windows Terminal, and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below into Windows Terminal, and press Enter. (see screenshot below step 3)


3 Make note of the SID (ex: "S-1-5-21-2212846312-626644311-134141314-1001") of the account name (ex: "Brink") you want to apply this to. (see screenshot below)


4 Open Registry Editor (regedit.exe).

5 Navigate to the registry key below in the left pane of Registry Editor. (see screenshot below)



6 Under the UserARSO key, click/tap on the subkey that has the same name as the SID (ex: "S-1-5-21-2212846312-626644311-134141314-1001") from step 3 above. (see screenshot below)


7 In the right pane of the SID (ex: "S-1-5-21-2212846312-626644311-134141314-1001") key, double click/tap on the OptOut DWORD to modify it. (see screenshot above)

8 Type 0 (on - default) or 1 (off) for what you want, and click/tap on OK. (see screenshot below)


9 You can now close Windows Terminal and Registry Editor if you like.

You must be signed in as an administrator to use this option.

The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.

All editions can use Option Four for the same policy.

1 Open the Local Group Policy Editor (gpedit.msc).

2 Navigate to the registry key location below in the left pane of Local Group Policy Editor. (see screenshot below)



3 In the right pane of Windows Logon Options, double click/tap on the Sign-in and lock last interactive user automatically after a restart policy to edit it. (see screenshot above)

4 Do step 5 (always enabled), step 6 (always disabled), step 7 (default) below for what you want.

This will override and prevent using Option One and Option Two.

This will override and prevent using Option One and Option Two.

This is the default setting.

This will allow using Option One and Option Two.

8 You can close the Local Group Policy Editor if you like.

You must be signed in as an administrator to use this option.

1 Do step 2 (always enabled), step 3 (always disabled), or step 4 (default) below for what you want.

This will override and prevent using Option One and Option Two.

If you like, you can further configure this setting through the Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot policy.

(Contents of REG file for reference)

This will override and prevent using Option One and Option Two.

(Contents of REG file for reference)

This is the default setting.

This will allow using Option One and Option Two.

(Contents of REG file for reference)

5 Save the .reg file to your desktop.

6 Double click/tap on the downloaded .reg file to merge it.

7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

8 You can delete the downloaded .reg file if you like.


That's it,
Shawn Brink