Microsoft explains why it wants you to switch to Microsoft account from Local account

TairikuOkami · Jun 14, 2024

BobOmb said:
with bitlocker enabled a local account can be just as secure, you just need to store your own key

Bitlocker is protected by the user account, a local account can not have a secure password, thus it is not protected.

BobOmb · Jun 14, 2024

TairikuOkami said:
Bitlocker is protected by the user account, a local account can not have a secure password, thus it is not protected.

there is no difference if the account is local or ms

if the drive is bitlocker locked you cannot access the user registry data to reset the user account

if the drive is bitlocker unlocked you can create a new admin user by booting WinPE against the same TPM

same behavior

andrew129260 · Jun 14, 2024

BobOmb said:
there is no difference if the account is local or ms

if the drive is bitlocker locked you cannot access the user registry data to reset the user account

if the drive is bitlocker unlocked you can create a new admin user by booting WinPE against the same TPM

same behavior

This is not true. Standard Bitlocker will by default be unlocked by the tpm when the machine boots. It's only protected if the drive is moved to another machine or different hardware. Booting off an external media with certain tools can be used to change a password or reset it for a local account.

Setting a bitlocker unlock pin or password to boot into windows is one of the ways you can prevent this.

A microsoft account is the only way to prevent a password from being changed by bootable media with or without bitlocker. You can harden things further by using 3 incorrect attempt lock out plus bitlocker with startup pin plus a microsoft account.

BobOmb · Jun 14, 2024

I still dont see where a microsoft account is needed, every feature you listed can be enabled on a local account

there is no mention of a microsoft account anywhere in that link

the fact that it can be remotely locked by too many failed attempts by any random person also makes me avoid using it.. (to be fair the same is true with all online accounts, but if you cant sign into your computer you need another device to start resetting passwords)

XxXxX · Jun 14, 2024

i use a local account and have it encrypted with VeraCrypt in fact last time i checked my Hotmail account i have no machines registered with Microsoft but my system is activated. i also have the install usb for Win11 sent up vis Rufus but if MS plays games i would just turn the internet off completely then install if that was the only way to install Windows and bypass MS.
i would not go back to Ubuntu while they force snaps on everybody so i will find ways to bypass any MS requirements ..

TairikuOkami · Jun 14, 2024

BobOmb said:
if the drive is bitlocker locked you cannot access the user registry data to reset the user account

Utilman method works on 24H2, you can change or remove local password within seconds (locally or remotely, if infected).

andrew129260 · Jun 14, 2024

BobOmb said:
I still dont see where a microsoft account is needed, every feature you listed can be enabled on a local account

there is no mention of a microsoft account anywhere in that link

the fact that it can be remotely locked by too many failed attempts by any random person also makes me avoid using it.. (to be fair the same is true with all online accounts, but if you cant sign into your computer you need another device to start resetting passwords)

You don't need another device. You can reset the password using your 2fa and other methods right on your device using forgot password link. The Microsoft account password cannot be modified at boot. You can try it yourself or see the multiple threads online. That's why it's safer than a local account.

But yes if your using a local account with bitlocker pin at boot, you will be protected from a password reset tool. But the default bitlocker behavior you will not.

BobOmb · Jun 14, 2024

they are good encryption tips @TairikuOkami

BobOmb · Jun 14, 2024

andrew129260 said:
The Microsoft account password cannot be modified at boot. You can try it yourself or see the multiple threads online. That's why it's safer than a local account.

Well, just to check it out, I just downloaded the latest Win11 from Microsoft's website, created a bootable Windows 11 install USB, did a normal install on a dummy machine and set it up using a Microsoft account... Then I turned on Bitlocker and rebooted. The machine is running on WiFi.

During boot at the login I had to wait for a network to connect before i could click anything and afterwards clicking the sign in option did nothing but return me to a lock screen.. the button border was missing and only the text Sign-In was there, smh

I can however confirm that the drive was also locked and completely inaccessible via bootable media :lmao:

No thanks on the MS account for login purposes ;P

Marcus Vinicus · Jun 14, 2024

BobOmb said:
what happens if someone remotely enters your email address for login creds and locks your account from across the planet?

That isn't going to happen with a Microsoft Account (and allied services) setup as mine is. It is password less and instead uses facial recognition as the principal login method with MFA via the Authenticator app in my mobile.

hdmi · Jun 15, 2024

Wisewiz said:
"A Microsoft account, on the other hand, is associated to an email address and password that you use with Outlook.com, Hotmail, Office, OneDrive, Skype, Xbox, and Windows."

Well, MS, I don't use Outlook.com, don't use Hotmail, don't use Office, don't use OneDrive (and never will), don't use Skype, don't use Xbox, and don't want the settings and files of my office computers synched unless I sync them. So p*ss off, MS!

Wisewiz · Jul 6, 2024

My guess is that that baby has just pooped his diaper, in which case, he is no longer full of it. Neither am I. Well, most of the time.

Microsoft explains why it wants you to switch to Microsoft account from Local account

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Microsoft 365 Basic

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Semper paratus

My Computers

Jack of all trades – master of none

My Computers

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Similar threads