Show Successfully Logged In Domain Users on Logon Screens

Question

I am working in a big organisation (200+ people) and we switched to Domain User login. Currently there are 10+ people working on the same computer throughout the day and currently typing in their username and password takes too much time.

I am looking for a solution where all the users that successfully logged in to the computer (So they have a profile created under Users folder) would show up on the logon screen. I followed a few guides already and searched for a solution but nothing comes close to what I need.

I already tried this Group Policy settings:

Block user from showing account details on sign-in - Disabled
Do not enumerate connected users on domain-joined computer - Disabled
Enumerate local users on domain-joined computers - Enabled

Thank you very much.

Best regards

Answer 1

I have had a similar situation with warehouse workers and shared terminals. We solved it by encoding the key sequence CTRL+ALT+DEL as a barcode then tabs to change user, enter, type username, tab to password field. https://support.honeywellaidc.com/s/article/CTRL-ALT-DEL-function-barcode

Everyone had the barcode printed on their ID badge, and most terminals had a sheet next to them with name and barcode, laminated.

All a user had to do was blip their name, and type password. Worked like a charm. I assume the same could be done with magstripe cards, but never tried. both barcode readers and mag stripe readers just emulate keyboard input.

Added plus is they are cheap, barcode reader is one to one computer, and labels are cheap to print. Mag cards one to one person and one to one computer, but cheap as well.

Though I agree that things like identity devices or fingerprint readers are functional and likely preferred modern solutions, they can also get expensive and can be fickle, and they are not suited for every situation.

Nutrition for cognition... :-)

Edit: I just started a cursory search on what it would actually take (What computers like to do and can do are often vastly different), and it seems this may be possible, but ever tried, http://woshub.com/how-to-show-all-users-accounts-on-windows-10-login-screen/

Also are you editing group policy at domain level or computer level. Does an RSOP show your desired settings? IT could be getting clobbered if local.

Answer 2

If they have logged out, this is not possible as described without writing custom code.

If you train them not to logout (because they are working on the same computer throughout the day) this is the default behavior to show all currently logged in users (they will still need to enter their password). You will however want to train them to save their work before walking away, come back to logout at the end of their shift, or you will want to implement other controls to automatically log them off overnight.

However it sounds like an XY problem. You have a picture of a possible solution in your mind, but trying to find that solution is distracting you from other solutions to your actual problem (logins taking too long).

Look at Windows Hello, smart cards, fingerprint readers, facial recognition (Windows Hello again). These are existing solutions that can automatically log in a user without even clicking on the login screen (or with various other permutations like a PIN). In particular, I've been using fingerprint readers for decades now to meet two similar requirements.

1. Multiple users need to quickly login - they just have to swipe one finger and they are in without touching a keyboard, mouse, or anything else except the fingerprint reader. Check carefully, as some (older) fingerprint readers have trouble with domain accounts... others like the one I use now work seamlessly (many many more than 200 users).
2. I have multiple accounts (regular account, admin account, test account, etc.) so I program different fingers to different accounts. Swipe my pinky I'm logged in as a test account, swipe my index finger for my regular account, swipe my other pinky for my admin account. Takes just a second or three to switch.

At the moment we are testing completely passwordless logins, as passwords are no longer considered sufficient for high security needs.

Answer 3

This is not possible. Windows will show you the last 2 (or so) users that logged on to that computer if you click the "switch user" button on the logon screen. Other than that, you are out of luck.

Answer 4

Maybe have a look at using something like yubikey for smart card login for users "passwordless":

https://support.yubico.com/hc/en-us/articles/360013707820-YubiKey-Smart-Card-Deployment-Guide

This isn't exactly what you asked for and it's not free either but it may be a usable solution for you. As already answered, altering the login screen isn't possible because it's designed not to be interfered with for security by design.