Interactive logon: Do not display last user name
Updated: November 15, 2012
Applies To: Windows Server 2003, Windows Vista, Windows XP, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8
This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting.
This security setting determines whether the name of the last user to log on to the computer is displayed on the Secure Desktop.
If this policy is enabled, the full name of the last user to successfully log on is not displayed on the Secure Desktop, nor is the user’s logon tile displayed. Additionally, if the Switch user feature is used, the full name and logon tile are not displayed. The logon screen requests a qualified domain account name (or local user name) and password.
If this policy is disabled, the full name of the last user to log on is displayed, and the user’s logon tile is displayed. This behavior is the same when the Switch user feature is used.
Your implementation of this policy depends on your security requirements for displayed logon information. If you have running computers that store sensitive data, with monitors displayed in unsecured locations, or if you have computers with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy.
Depending on your security policy, you might also want to enable the Interactive logon: Display user information when the session is locked policy, which will prevent the Windows operating system from displaying the logon name when the session is locked or started.
GPO_name\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Server type or Group Policy object (GPO)
Default domain policy
Default domain controller policy
Stand-alone server default settings
Domain controller effective default settings
Member server effective default settings
Effective GPO default settings on client computers
There are no differences in this policy between operating systems beginning with Windows Server 2008 and Windows Vista.
This section describes features and tools that are available to help you manage this policy.
None. Changes to this policy become effective without a computer restart when they are saved locally or distributed through Group Policy.
This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in.
This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation.
An attacker with access to the console (for example, someone with physical access or someone who can connect to the computer through Remote Desktop Session Host (RD Session Host)) could view the name of the last user who logged on. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try to log on.
Enable the Interactive logon: Do not display last user name setting.
Users must always type their user names and passwords when they log on locally or to the domain. The logon tiles of all logged on users are not displayed.