I need to improve our account management (using Active Directory) for a customer support site with 50+ computers.

The default "AD"-way is to give each user their own account. This adds up with a lot of administration with adding/disabling/enabling user accounts.

To avoid this supervisors have started to use shared "general" accounts like domain\callcenter2 etc and I don't like the idea of everyone knowing and sharing accounts and passwords.

Our ideal solution would be to create a group with computers which requires no login by the user. I.e. the users just have to start the computer.

  • Should I configure auto-logon with a single user account like domain\agentAccount?
  • Is there anything else to consider if I use the same account for all users?
  • How do I configure the actual auto-logon with a GPO on the group? Is there a "Microsoft way" without 3rd party plugins?

Or is there a better solution?


You can configure autologon on a computer by computer basis by setting the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName (E.g. DOMAIN\USERNAME)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword Password in plain text

You could configure this using Group Policy Preferences. However, there are two clear security risks - firstly, the plain text password and secondly, as have an automatic login you may aswell just let everyone have the passwords.

There are a couple of technical issues with sharing user accounts, such as user customisations, profiles etc. However, the biggest problem will be accountability.

To me, this feels like a classic case of using technology to solve a social issue. You need to go up your chain of command and design an Acceptable Use Policy that stipulates:

  • All users must use their own user account
  • No user should ever disclose their password
  • Users must log off, or lock their workstation when not in use

Every other company manages to get people to use their own user account and password, and you should be no different.

  • Thanks! I totally agree with you about this being a social issue. But technically, let's say we install 5 computers in our reception for guests to use while waiting for someone. How do I keep them logged in at all times? Oct 23 '12 at 10:07
  • @JonasStensved Fair question and the above registry keys will work great. In the event of a log off, they'll just log straight back on unless you hold shift.
    – Dan
    Oct 23 '12 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.