We have a Windows Server 2008R2 server which is running our domain.

We have around 40 users and around 30 computers. Most of the users have their own dedicated workstation, however around 5 of the computers get logged in by one person every morning and then everyone just uses their profile for the brief duration they need to check something (usually about 2 minutes at a time).

I was wondering if it is possible to have these 5 computers in their own OU on the domain and then somehow make them auto login to a generic user account that doesn't have any of the usual drive mappings etc.

Someone could power the machines on in the morning and they boot straight into a locked version of the usual user profile.

Is this possible?


Sure. You can do that.

Create the "generic" account and give it permission to whatever you need to. Set a password for the account and use Group Policy to make the autologon happen.

There isn't a stock Group Policy template to control autologon. A simple template would be something like:


    CATEGORY "Logon"
        POLICY "Auto Logon"
            KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 
            VALUENAME "AutoAdminLogon" 
            VALUEON "1" 
            VALUEOFF "0"

            PART "Username" EDITTEXT 
                VALUENAME "DefaultUserName" 
            END PART 

            PART "Domain" EDITTEXT 
                VALUENAME "DefaultDomainName" 
            END PART 

            PART "Password" EDITTEXT 
                VALUENAME "DefaultPassword" 
            END PART
        END POLICY
    END CATEGORY ; "Logon"

Save that in an ".ADM" file, create your OU and GPO linked to it, and edit the GPO. In the Group Policy editor you'll need to right-click "Administrative Templates" and "Add/Remove Templates" to add this template. You'll find these settings under "Classic Administrative Templates".

Bear in mind that this setting will "tattoo" the registry of the PCs you apply it to. When you move them out of the OU they'll retain the autologon settings. Either remove them via script or relocate the PCs to an an OU with an "evil anti-policy" GPO linked that has the autologon setting disabled to un-tattoo them.

If you want some specific Group Policy settings to apply to the generic user account be sure you put that user object in the proper location and give it the proper group memberships, etc.

  • 2
    +1 for the demonstration on creating a custom .adm file. – HostBits Apr 30 '11 at 18:07
  • @Cheekaleak: I don't know how many times I've used that one IRL. It's nice to finally use it in an answer on here. – Evan Anderson Apr 30 '11 at 18:08
  • Am I right in thinking I leave that script intact (not replacing the DefaultUsername etc.) and editing it using the GPO management panel? – dannymcc May 2 '11 at 13:30
  • @dannymcc: You are correct. The "code" portion of my post is an "Administrative Template" (in the old "legacy" style-- not the new "ADMX" style). Once you've added it to the Group Policy editor you'll be able to add settings for the registry values the ADM file refers to via the Group Policy editor GUI. – Evan Anderson May 2 '11 at 15:05

It is possible. Create an OU for the computers, move the computers to the OU, create the generic user account in the OU, create a GPO for the OU and link it to the OU, set the appropriate computer and user settings in the OU, and set the neccessary registry information on the computers to automatically login the generic user.

If you don't want higher level GPO settings applied to the OU then you can block inheritance on the new OU. You could also use GPO security Filtering on the higher level OU's to apply them to a group that contains everything but the generic user and the 5 computers, but it's safer and less cumbersome to block inheritance on the specific OU.


Yes, just create a user account with a nice functional name and the right permissions. It's that simple.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.