Require username & password for every new Windows user

This step-by-step PDF explains, in full detail, how to configure a Windows PC so that
every new user must provide a username and password when signing in. It covers multiple
methods (Settings, netplwiz, local users, Local Group Policy, PowerShell), Windows
version notes (Windows 10/11), and extra security recommendations. Follow each step
carefully; administrative privileges are required for several steps.
Contents
1. Disable automatic login (netplwiz)
2. Create users with passwords (Settings)
3. Enforce no blank passwords (Local Group Policy / Security Policy)
4. Force password change at first logon ([Link])
5. Create users via PowerShell (script)
6. Additional security settings and tips
7. Troubleshooting and FAQs
8. Appendix: Commands and sample scripts
1) Disable automatic login (netplwiz)
Why: If Windows is set to automatically sign in to an account, new users won't be
prompted on the sign-in screen. Disabling automatic login makes Windows show the sign-
in screen where users must enter credentials.
Steps (works on Windows 10 & 11):
1. Press Windows + R to open Run dialog.
2. Type: netplwiz and press Enter. This opens the User Accounts dialog (Advanced user
management).
3. In the dialog, find the checkbox labeled: 'Users must enter a user name and password
to use this computer'.
4. **Make sure this checkbox IS CHECKED.** If it is unchecked, Windows will
automatically sign in to the stored account.
5. Click Apply → OK to save changes.
Notes & troubleshooting:
- If 'netplwiz' does not open or gives an error, you may not have Windows Pro/Home
differences, but this utility exists on most consumer Windows installs.
- If you prefer a command-line approach, Automatic login settings are stored in the
registry at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
(DefaultUserName, DefaultPassword, AutoAdminLogon). Editing the registry is risky; only
do so if comfortable and back up registry first.
- To remove automatic login via registry (advanced):
1) Open regedit as Administrator.
2) Go to the path above.
3) Remove DefaultPassword value and set AutoAdminLogon to 0.
2) Create users with passwords (Settings)
Why: When adding a new user, ensure you set a password in the creation flow so the
account is not created as blank-password user.
Steps for Windows 10 & 11 (local account method):
1. Open Settings (Windows + I).
2. Go to Accounts → Family & other users (Windows 10) or Accounts → Other users
(Windows 11).
3. Click 'Add someone else to this PC' (Windows 10) or 'Add account' / 'Add someone
else to this PC'.
4. If prompted for Microsoft account, choose 'I don't have this person's sign-in
information' and then 'Add a user without a Microsoft account'.
5. Enter the new user's username. IMPORTANT: Provide a password and confirm it. Fill a
password hint (useful if they forget).
6. Click Next / Finish. The new account will have a password and require credentials at
sign in.
Notes:
- If you want users to create their own passwords at first login, create the account
and then set the flag 'User must change password at next logon' (see Section 4).
- Microsoft accounts may be used instead of local accounts; MS accounts always require
signing in with credentials (email + password or Windows Hello).
3) Enforce no blank passwords using Local Group Policy / Security Policy
Why: Windows can allow blank local passwords in some scenarios; enforce policies to
prevent blank passwords and require complexity.
Method A — Local Group Policy ([Link]) — Windows Pro / Enterprise:
1. Press Windows + R, type [Link], press Enter.
2. In Local Group Policy Editor, navigate to:
Computer Configuration → Windows Settings → Security Settings → Local Policies →
Security Options
3. Find the policy: 'Accounts: Limit local account use of blank passwords to console
logon only'.
4. Set this policy to 'Enabled'. This prevents blank passwords from being used over the
network and limits them to console logon only.
5. Optional: Configure 'Interactive logon: Do not require CTRL+ALT+DEL' — for extra
security, set to Require Ctrl+Alt+Del by enabling 'Interactive logon: Require users to
press Ctrl+Alt+Del' (recommended).
Method B — Local Security Policy ([Link]) — where available:
1. Press Windows + R, type [Link], press Enter.
2. Check the same Security Options under Local Policies.
Notes for Home edition:
- Windows Home doesn't include [Link] by default. You can enforce policies via
registry edits or use PowerShell scripts and secure configuration management tools. For
many settings, the registry path corresponds to the policy. Use caution and back up
registry first.
- Example registry key for blank password limitation: depends on policy; use
authoritative Microsoft documentation before editing registry.
4) Force password change at next logon ([Link])
Why: If you want the user to choose their own password at first sign-in, create the
account and force them to change password at next logon.
Steps (Windows Pro/Enterprise — [Link]):
1. Press Windows + R, type [Link], and press Enter. This opens Local Users and
Groups.
2. Click 'Users' in the left pane.
3. Right-click the new user account and select Properties.
4. In the Properties window, check 'User must change password at next logon'.
5. Click OK.
Notes:
- [Link] is not available on Windows Home edition. Use PowerShell commands (see
Section 5) to set the 'PasswordExpires' or 'User must change password' flag when
creating the account.
- If you need to set this flag in PowerShell for an existing local user, use the ADSI
approach or local user cmdlets depending on availability.
5) Create users via PowerShell (recommended for scripting / automation)
Why: PowerShell lets admins create local users programmatically and ensure password
presence and settings like 'User must change password at next logon'. Useful for
multiple accounts or templates.
Run PowerShell as Administrator. Below are example commands and scripts that work on
modern Windows 10/11 with the LocalAccounts module.
A) Interactive secure password prompt and create user:
Steps:
1. Open PowerShell as Administrator (right-click Start → Windows PowerShell (Admin) or
search PowerShell, right-click and Run as administrator).
2. Run these commands (replace 'newusername' with the desired username):
$pw = Read-Host -Prompt 'Enter password for new user' -AsSecureString
New-LocalUser -Name 'newusername' -Password $pw -FullName 'Full Name' -Description
'Created by admin'
Add-LocalGroupMember -Group 'Users' -Member 'newusername'
3. To force password change at next logon (if New-LocalUser cmdlet supports it), use:
Set-LocalUser -Name 'newusername' -PasswordNeverExpires $false
Note: PowerShell built-in cmdlets may vary by Windows version. If 'Set-LocalUser' or
'New-LocalUser' are not available, use the ADSI method shown below.
B) ADSI method (compatible on more systems) to set 'User must change password' flag:
Example script (run as admin):
$username = "newusername"
$password = "P@ssw0rd!" # For automation only — avoid plaintext in scripts; prefer
SecureString
$computer = [ADSI]"WinNT://$env:COMPUTERNAME,computer"
$user = $[Link]("User", $username)
$[Link]($password)
$[Link]("FullName", "Full Name")
$[Link]("Description", "Created by admin")
$[Link]()
# Force change at next logon:
$[Link]("PasswordExpired", 1)
$[Link]()

Security notes for scripts:

- Never store plaintext passwords in scripts in production. Use SecureString or a
secret store (Azure Key Vault, local encrypted store).
- Run scripts from an elevated (Administrator) PowerShell prompt.
- Test scripts in a virtual machine before applying to production machines.
6) Additional security settings & recommendations
1. Enforce password complexity and minimum length using Group Policy:
- Open [Link] → Computer Configuration → Windows Settings → Security Settings →
Account Policies → Password Policy.
- Configure 'Minimum password length', 'Password must meet complexity requirements',
and 'Maximum password age' as appropriate.
2. Disable the built-in Guest account and remove unnecessary local accounts.
3. Require Ctrl+Alt+Del for interactive logon (Security Options) for added protection
against credential theft.
4. Consider using Microsoft accounts or Azure AD Join for enterprise-managed devices —
they provide centralized policy and password controls.
5. Turn on Windows Hello (PIN / biometric) as an additional sign-in option, but still
enforce password for local/admin accounts.
6. Keep an admin account but do routine tasks from standard user accounts to limit
malware impact (use 'Run as administrator' when needed).
7) Troubleshooting & Frequently Asked Questions (FAQ)
Q: I don't see [Link] or [Link] on Windows Home. What can I do?
A: Windows Home lacks these management consoles. Use PowerShell cmdlets (New-LocalUser,
Set-LocalUser) or registry edits. For complex policies, consider upgrading to Pro or
use management tools (MDM, Microsoft Intune).
Q: I enabled 'Users must enter a user name and password' but still log in
automatically.
A: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon and ensure DefaultPassword is removed and AutoAdminLogon is
0. Also verify any third-party tools (credential managers) are not signing in
automatically.
Q: How do I require a new user to create their own password at first login?
A: Create the account with an initial temporary password, then set 'User must change
password at next logon' via [Link] or PowerShell (set
PasswordExpired/PasswordNeverExpires flags appropriately).
Q: Can I require passwords for domain accounts?
A: Domain accounts are controlled by Active Directory policies; use AD password
policies, Group Policy Objects (GPOs), and domain controllers to enforce password
creation and complexity.
8) Appendix: Useful commands & references
Netplwiz (GUI):
- Run: Windows+R → netplwiz
Local Users and Groups (GUI):
- Run: [Link] (not on Home edition)
Local Group Policy: [Link] (Pro/Enterprise)
Local Security Policy: [Link] (where available)
PowerShell snippets (run as Administrator):
$pw = Read-Host -Prompt 'Enter password for new user' -AsSecureString
New-LocalUser -Name 'newusername' -Password $pw -FullName 'Full Name' -Description
'Created by admin'
Add-LocalGroupMember -Group 'Users' -Member 'newusername'
Final notes:
- Always test changes on a non-production machine first.
- Keep backups and, when editing registry, export keys beforehand.
- For enterprise environments, use centralized management (Active Directory, Azure AD,
Group Policy, Intune) for consistent enforcement across many devices.

Created by ChatGPT — Detailed step-by-step Windows user account guide